Summary

The table below shows the numbers of issues identified in different categories. Issues are classified according to severity as High, Medium, Low, Information or False Positive. This reflects the likely impact of each issue for a typical organization. Issues are also classified according to confidence as Certain, Firm or Tentative. This reflects the inherent reliability of the technique that was used to identify the issue.

		Confidence
		Certain	Firm	Tentative	Total
Severity	High	0	0	0	0
	Medium	0	0	1	1
	Low	0	13	1	14
	Information	65	29	0	94
	False Positive	0	0	0	0

The chart below shows the aggregated numbers of issues identified in each category. Solid colored bars represent issues with a confidence level of Certain, and the bars fade as the confidence level falls.

		Number of issues
		0	10	20	30	40	50	60	70	80	90
Severity	High
	Medium
	Low

Contents

1. Cross-site request forgery

2. Client-side JSON injection (DOM-based)

2.1. https://helpdesk-dev.zalaris.com/

2.2. https://helpdesk-dev.zalaris.com/510

2.3. https://helpdesk-dev.zalaris.com/510/tickets/new/duplicate-test

2.4. https://helpdesk-dev.zalaris.com/510/tickets/new/generic-form

2.5. https://helpdesk-dev.zalaris.com/510/tickets/new/phone-benefits

2.6. https://helpdesk-dev.zalaris.com/510/tickets/new/predefined-template

2.7. https://helpdesk-dev.zalaris.com/510/tickets/new/test-template-1

2.8. https://helpdesk-dev.zalaris.com/510/tickets/new/zalaris-ind

2.9. https://helpdesk-dev.zalaris.com/777

2.10. https://helpdesk-dev.zalaris.com/777/tickets/new/phone-benefits

3. Open redirection (DOM-based)

4. Cookie manipulation (DOM-based)

4.1. https://helpdesk-dev.zalaris.com/510

4.2. https://helpdesk-dev.zalaris.com/510/tickets/new/generic-form

4.3. https://helpdesk-dev.zalaris.com/510/tickets/new/phone-benefits

5. Cross-site scripting (reflected)

5.1. https://helpdesk-dev.zalaris.com/api/v1/tickets [size parameter]

5.2. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [filename multipart parameter attribute]

6. External service interaction (DNS)

7. User agent-dependent response

8. Input returned in response (stored)

8.1. https://helpdesk-dev.zalaris.com/api/v1/drafts [categoryId JSON parameter]

8.2. https://helpdesk-dev.zalaris.com/api/v1/drafts [subject JSON parameter]

8.3. https://helpdesk-dev.zalaris.com/api/v1/drafts [templateId JSON parameter]

8.4. https://helpdesk-dev.zalaris.com/api/v1/tickets/549830/feedback [text JSON parameter]

8.5. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [p XML parameter within the text parameter]

8.6. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [p XML parameter within the text parameter]

8.7. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [text parameter]

8.8. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [text parameter]

8.9. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/resolve [text JSON parameter]

8.10. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/resolve [text JSON parameter]

9. Input returned in response (reflected)

9.1. https://helpdesk-dev.zalaris.com/api/v1/cms/notes [URL path filename]

9.2. https://helpdesk-dev.zalaris.com/api/v1/cms/notes [URL path folder 2]

9.3. https://helpdesk-dev.zalaris.com/api/v1/cms/notes [URL path folder 3]

9.4. https://helpdesk-dev.zalaris.com/api/v1/cms/updates [URL path filename]

9.5. https://helpdesk-dev.zalaris.com/api/v1/cms/updates [URL path folder 3]

9.6. https://helpdesk-dev.zalaris.com/api/v1/contacts/authenticatedUser [URL path filename]

9.7. https://helpdesk-dev.zalaris.com/api/v1/contacts/authenticatedUser [URL path folder 3]

9.8. https://helpdesk-dev.zalaris.com/api/v1/drafts [URL path filename]

9.9. https://helpdesk-dev.zalaris.com/api/v1/drafts [URL path folder 2]

9.10. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87 [URL path filename]

9.11. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87 [URL path folder 2]

9.12. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87 [URL path folder 3]

9.13. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files [URL path filename]

9.14. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files [URL path folder 2]

9.15. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files [URL path folder 3]

9.16. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files [URL path folder 4]

9.17. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/submit [URL path filename]

9.18. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/submit [URL path folder 4]

9.19. https://helpdesk-dev.zalaris.com/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d [URL path filename]

9.20. https://helpdesk-dev.zalaris.com/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d [URL path folder 2]

9.21. https://helpdesk-dev.zalaris.com/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d [URL path folder 3]

9.22. https://helpdesk-dev.zalaris.com/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit [URL path filename]

9.23. https://helpdesk-dev.zalaris.com/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit [URL path folder 2]

9.24. https://helpdesk-dev.zalaris.com/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit [URL path folder 3]

9.25. https://helpdesk-dev.zalaris.com/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit [URL path folder 4]

9.26. https://helpdesk-dev.zalaris.com/api/v1/notifications [URL path filename]

9.27. https://helpdesk-dev.zalaris.com/api/v1/notifications [URL path folder 2]

9.28. https://helpdesk-dev.zalaris.com/api/v1/templates/categories [URL path filename]

9.29. https://helpdesk-dev.zalaris.com/api/v1/templates/categories [URL path folder 3]

9.30. https://helpdesk-dev.zalaris.com/api/v1/templates/slug/phone-benefits [URL path folder 3]

9.31. https://helpdesk-dev.zalaris.com/api/v1/templates/slug/phone-benefits [URL path folder 4]

9.32. https://helpdesk-dev.zalaris.com/api/v1/tickets [size parameter]

9.33. https://helpdesk-dev.zalaris.com/api/v1/tickets/549830 [URL path filename]

9.34. https://helpdesk-dev.zalaris.com/api/v1/tickets/549830 [URL path folder 3]

9.35. https://helpdesk-dev.zalaris.com/api/v1/tickets/549830/feedback [URL path filename]

9.36. https://helpdesk-dev.zalaris.com/api/v1/tickets/549830/feedback [URL path folder 2]

9.37. https://helpdesk-dev.zalaris.com/api/v1/tickets/549830/feedback [URL path folder 3]

9.38. https://helpdesk-dev.zalaris.com/api/v1/tickets/549830/feedback [URL path folder 4]

9.39. https://helpdesk-dev.zalaris.com/api/v1/tickets/549849 [URL path filename]

9.40. https://helpdesk-dev.zalaris.com/api/v1/tickets/549849 [URL path folder 3]

9.41. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951 [URL path folder 3]

9.42. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [URL path filename]

9.43. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [URL path folder 4]

9.44. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [filename multipart parameter attribute]

9.45. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/resolve [URL path filename]

9.46. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/resolve [URL path folder 3]

9.47. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/resolve [URL path folder 4]

9.48. https://helpdesk-dev.zalaris.com/api/v1/tickets/byDraft/2e5e5387853243a4862aa6b212f30e87 [URL path filename]

9.49. https://helpdesk-dev.zalaris.com/api/v1/tickets/byDraft/2e5e5387853243a4862aa6b212f30e87 [URL path folder 4]

9.50. https://helpdesk-dev.zalaris.com/api/v1/tickets/byDraft/8b8eb30dc69941c19f8d7c99984cb28d [URL path filename]

9.51. https://helpdesk-dev.zalaris.com/api/v1/tickets/byDraft/8b8eb30dc69941c19f8d7c99984cb28d [URL path folder 4]

10. Frameable response (potential Clickjacking)

11. HTML5 storage manipulation (DOM-based)

11.1. https://helpdesk-dev.zalaris.com/

11.2. https://helpdesk-dev.zalaris.com/

11.3. https://helpdesk-dev.zalaris.com/510

11.4. https://helpdesk-dev.zalaris.com/510

11.5. https://helpdesk-dev.zalaris.com/510

11.6. https://helpdesk-dev.zalaris.com/510/tickets/new/duplicate-test

11.7. https://helpdesk-dev.zalaris.com/510/tickets/new/duplicate-test

11.8. https://helpdesk-dev.zalaris.com/510/tickets/new/generic-form

11.9. https://helpdesk-dev.zalaris.com/510/tickets/new/generic-form

11.10. https://helpdesk-dev.zalaris.com/510/tickets/new/generic-form

11.11. https://helpdesk-dev.zalaris.com/510/tickets/new/phone-benefits

11.12. https://helpdesk-dev.zalaris.com/510/tickets/new/phone-benefits

11.13. https://helpdesk-dev.zalaris.com/510/tickets/new/phone-benefits

11.14. https://helpdesk-dev.zalaris.com/510/tickets/new/predefined-template

11.15. https://helpdesk-dev.zalaris.com/510/tickets/new/predefined-template

11.16. https://helpdesk-dev.zalaris.com/510/tickets/new/test-template-1

11.17. https://helpdesk-dev.zalaris.com/510/tickets/new/test-template-1

11.18. https://helpdesk-dev.zalaris.com/510/tickets/new/zalaris-ind

11.19. https://helpdesk-dev.zalaris.com/510/tickets/new/zalaris-ind

11.20. https://helpdesk-dev.zalaris.com/777

11.21. https://helpdesk-dev.zalaris.com/777

11.22. https://helpdesk-dev.zalaris.com/777/tickets/new/phone-benefits

11.23. https://helpdesk-dev.zalaris.com/777/tickets/new/phone-benefits

11.24. https://helpdesk-dev.zalaris.com/management/links/new

11.25. https://helpdesk-dev.zalaris.com/management/links/new

11.26. https://helpdesk-dev.zalaris.com/management/links/new

12. Base64-encoded data in parameter

13. TLS certificate

1. Cross-site request forgery
Next

Summary

	Severity:	Medium
	Confidence:	Tentative
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549951/entries

Issue detail

The request appears to be vulnerable to cross-site request forgery (CSRF) attacks against authenticated users.

Issue background

Cross-site request forgery (CSRF) vulnerabilities may arise when applications rely solely on HTTP cookies to identify the user that has issued a particular request. Because browsers automatically add cookies to requests regardless of their origin, it may be possible for an attacker to create a malicious web site that forges a cross-domain request to the vulnerable application. For a request to be vulnerable to CSRF, the following conditions must hold:

• The request can be issued cross-domain, for example using an HTML form. If the request contains non-standard headers or body content, then it may only be issuable from a page that originated on the same domain.
• The application relies solely on HTTP cookies or Basic Authentication to identify the user that issued the request. If the application places session-related tokens elsewhere within the request, then it may not be vulnerable.
• The request performs some privileged action within the application, which modifies the application's state based on the identity of the issuing user.
• The attacker can determine all the parameters required to construct a request that performs the action. If the request contains any values that the attacker cannot determine or predict, then it is not vulnerable.

Issue remediation

The most effective way to protect against CSRF vulnerabilities is to include within relevant requests an additional token that is not transmitted in a cookie: for example, a parameter in a hidden form field. This additional token should contain sufficient entropy, and be generated using a cryptographic random number generator, such that it is not feasible for an attacker to determine or predict the value of any token that was issued to another user. The token should be associated with the user's session, and the application should validate that the correct token is received before performing any action resulting from the request.

An alternative approach, which may be easier to implement, is to validate that Host and Referer headers in relevant requests are both present and contain the same domain name. However, this approach is somewhat less robust: historically, quirks in browsers and plugins have often enabled attackers to forge cross-domain requests that manipulate these headers to bypass such defenses.

References

• Web Security Academy: Cross-site request forgery
• Using Burp to Test for Cross-Site Request Forgery
• The Deputies Are Still Confused

Vulnerability classifications

• CWE-352: Cross-Site Request Forgery (CSRF)
• CAPEC-62: Cross Site Request Forgery

Request 1

Response 1

Request 2

Response 2

2. Client-side JSON injection (DOM-based)
Previous  Next

There are 10 instances of this issue:

• /
• /510
• /510/tickets/new/duplicate-test
• /510/tickets/new/generic-form
• /510/tickets/new/phone-benefits
• /510/tickets/new/predefined-template
• /510/tickets/new/test-template-1
• /510/tickets/new/zalaris-ind
• /777
• /777/tickets/new/phone-benefits

Issue background

DOM-based vulnerabilities arise when a client-side script reads data from a controllable part of the DOM (for example, the URL) and processes this data in an unsafe way.

DOM-based JSON injection arises when a script incorporates controllable data into a string that is parsed as a JSON data structure and then processed by the application. An attacker may be able to use this behavior to construct a URL that, if visited by another application user, will cause arbitrary JSON data to be processed. Depending on the purpose for which this data is used, it may be possible to subvert the application's logic, or cause unintended actions on behalf of the user.

Burp Suite automatically identifies this issue using dynamic and static code analysis. Static analysis can lead to false positives that are not actually exploitable. If Burp Scanner has not provided any evidence resulting from dynamic analysis, you should review the relevant code and execution paths to determine whether this vulnerability is indeed present, or whether mitigations are in place that would prevent exploitation.

Issue remediation

The most effective way to avoid DOM-based JSON injection vulnerabilities is not to parse as JSON any string containing data that originated from an untrusted source. If the desired functionality of the application means that this behavior is unavoidable, then defenses must be implemented within the client-side code to prevent malicious data from modifying the JSON structure in inappropriate ways. This may involve strict validation of specific items to ensure they do not contain any characters that may interfere with the structure of the JSON when it is parsed.

References

• Web Security Academy: Client-side JSON injection (DOM-based)

Vulnerability classifications

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CWE-116: Improper Encoding or Escaping of Output
• CWE-159: Failure to Sanitize Special Element
• CAPEC-153: Input Data Manipulation

2.1. https://helpdesk-dev.zalaris.com/
Next

Summary

	Severity:	Low
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/

Issue detail

The application may be vulnerable to DOM-based client-side JSON injection. Data is read from postMessage and passed to JSON.parse.

Request 1

Response 1

Dynamic analysis

Data is read from postMessage and passed to JSON.parse.

The following value was injected into the event handler and reached the sink without any modification:

x8fkmv5qqb%2527%2522`'"/x8fkmv5qqb/><x8fkmv5qqb/\>wvno86yxrk&

The stack trace at the source was:

at _0x576d9d (<anonymous>:1:418076)

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lfqNk (<anonymous>:1:104147)
at Object.AWngC (<anonymous>:1:438456)
at _0x3fd616.<computed> (<anonymous>:1:463194)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390285
at Object.HSSaF (<anonymous>:1:409571)
at _0x576d9d (<anonymous>:1:419059)

The stack trace at the event listener was:

at Object.BQODu (<anonymous>:1:95774)
at Object.pLXLD (<anonymous>:1:395292)
at Object.UyhhO (<anonymous>:1:404582)
at <anonymous>:1:409830
at 47984 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390223)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78125 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3029625)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78952 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3033069)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 89106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3400082)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 93106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3452584)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 7235 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:277171)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 58200 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1576909)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 86994 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3334892)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6167160
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The event listener that receives the message does not validate the origin.

This was triggered by a message event.

The origin used in the proof of concept was:

https://helpdesk-dev.zalaris.com.fakezalaris.com

The following proof of concept was generated for this issue:

<script>
function poc(){
window.win=window.open('https://helpdesk-dev.zalaris.com/');
var msg='';
setTimeout(function(){win.postMessage(msg,'*');}, 5000);
}
</script>
<a href="#" onclick="poc();">PoC</a>

2.2. https://helpdesk-dev.zalaris.com/510
Previous  Next

Summary

	Severity:	Low
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510

Issue detail

The application may be vulnerable to DOM-based client-side JSON injection. Data is read from postMessage and passed to JSON.parse.

Request 1

Response 1

Dynamic analysis

Data is read from postMessage and passed to JSON.parse.

The following value was injected into the event handler and reached the sink without any modification:

p5mrdet609%2527%2522`'"/p5mrdet609/><p5mrdet609/\>lrakedmt92&

The stack trace at the source was:

at _0x576d9d (<anonymous>:1:418076)

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lfqNk (<anonymous>:1:104147)
at Object.AWngC (<anonymous>:1:438456)
at _0x3fd616.<computed> (<anonymous>:1:463194)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390285
at Object.HSSaF (<anonymous>:1:409571)
at _0x576d9d (<anonymous>:1:419059)

The stack trace at the event listener was:

at Object.BQODu (<anonymous>:1:95774)
at Object.pLXLD (<anonymous>:1:395292)
at Object.UyhhO (<anonymous>:1:404582)
at <anonymous>:1:409830
at 47984 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390223)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78125 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3029625)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78952 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3033069)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 89106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3400082)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 93106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3452584)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 7235 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:277171)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 58200 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1576909)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 86994 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3334892)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6167160
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The event listener that receives the message does not validate the origin.

This was triggered by a message event.

The origin used in the proof of concept was:

https://helpdesk-dev.zalaris.com.fakezalaris.com

The following proof of concept was generated for this issue:

<script>
function poc(){
window.win=window.open('https://helpdesk-dev.zalaris.com/510');
var msg='';
setTimeout(function(){win.postMessage(msg,'*');}, 5000);
}
</script>
<a href="#" onclick="poc();">PoC</a>

2.3. https://helpdesk-dev.zalaris.com/510/tickets/new/duplicate-test
Previous  Next

Summary

	Severity:	Low
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/duplicate-test

Issue detail

The application may be vulnerable to DOM-based client-side JSON injection. Data is read from postMessage and passed to JSON.parse.

Request 1

Response 1

Dynamic analysis

Data is read from postMessage and passed to JSON.parse.

The following value was injected into the event handler and reached the sink without any modification:

zuyxqzpz9p%2527%2522`'"/zuyxqzpz9p/><zuyxqzpz9p/\>zdag4q3chj&

The stack trace at the source was:

at _0x576d9d (<anonymous>:1:418076)

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lfqNk (<anonymous>:1:104147)
at Object.AWngC (<anonymous>:1:438456)
at _0x3fd616.<computed> (<anonymous>:1:463194)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390285
at Object.HSSaF (<anonymous>:1:409571)
at _0x576d9d (<anonymous>:1:419059)

The stack trace at the event listener was:

at Object.BQODu (<anonymous>:1:95774)
at Object.pLXLD (<anonymous>:1:395292)
at Object.UyhhO (<anonymous>:1:404582)
at <anonymous>:1:409830
at 47984 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390223)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78125 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3029625)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78952 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3033069)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 89106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3400082)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 93106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3452584)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 7235 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:277171)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 58200 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1576909)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 86994 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3334892)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6167160
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The event listener that receives the message does not validate the origin.

This was triggered by a message event.

The origin used in the proof of concept was:

https://helpdesk-dev.zalaris.com.fakezalaris.com

The following proof of concept was generated for this issue:

<script>
function poc(){
window.win=window.open('https://helpdesk-dev.zalaris.com/510/tickets/new/duplicate-test');
var msg='';
setTimeout(function(){win.postMessage(msg,'*');}, 5000);
}
</script>
<a href="#" onclick="poc();">PoC</a>

2.4. https://helpdesk-dev.zalaris.com/510/tickets/new/generic-form
Previous  Next

Summary

	Severity:	Low
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/generic-form

Issue detail

The application may be vulnerable to DOM-based client-side JSON injection. Data is read from postMessage and passed to JSON.parse.

Request 1

Response 1

Dynamic analysis

Data is read from postMessage and passed to JSON.parse.

The following value was injected into the event handler and reached the sink without any modification:

w3ctikktrs%2527%2522`'"/w3ctikktrs/><w3ctikktrs/\>vvlu2ab5r7&

The stack trace at the source was:

at _0x576d9d (<anonymous>:1:418076)

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lfqNk (<anonymous>:1:104147)
at Object.AWngC (<anonymous>:1:438456)
at _0x3fd616.<computed> (<anonymous>:1:463194)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390285
at Object.HSSaF (<anonymous>:1:409571)
at _0x576d9d (<anonymous>:1:419059)

The stack trace at the event listener was:

at Object.BQODu (<anonymous>:1:95774)
at Object.pLXLD (<anonymous>:1:395292)
at Object.UyhhO (<anonymous>:1:404582)
at <anonymous>:1:409830
at 47984 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390223)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78125 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3029625)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78952 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3033069)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 89106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3400082)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 93106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3452584)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 7235 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:277171)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 58200 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1576909)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 86994 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3334892)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6167160
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The event listener that receives the message does not validate the origin.

This was triggered by a message event.

The origin used in the proof of concept was:

https://helpdesk-dev.zalaris.com.fakezalaris.com

The following proof of concept was generated for this issue:

<script>
function poc(){
window.win=window.open('https://helpdesk-dev.zalaris.com/510/tickets/new/generic-form');
var msg='';
setTimeout(function(){win.postMessage(msg,'*');}, 5000);
}
</script>
<a href="#" onclick="poc();">PoC</a>

2.5. https://helpdesk-dev.zalaris.com/510/tickets/new/phone-benefits
Previous  Next

Summary

	Severity:	Low
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/phone-benefits

Issue detail

The application may be vulnerable to DOM-based client-side JSON injection. Data is read from postMessage and passed to JSON.parse.

Request 1

Response 1

Dynamic analysis

Data is read from postMessage and passed to JSON.parse.

The following value was injected into the event handler and reached the sink without any modification:

zuz1m0lo6k%2527%2522`'"/zuz1m0lo6k/><zuz1m0lo6k/\>uizpct19y4&

The stack trace at the source was:

at _0x576d9d (<anonymous>:1:418076)

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lfqNk (<anonymous>:1:104147)
at Object.AWngC (<anonymous>:1:438456)
at _0x3fd616.<computed> (<anonymous>:1:463194)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390285
at Object.HSSaF (<anonymous>:1:409571)
at _0x576d9d (<anonymous>:1:419059)

The stack trace at the event listener was:

at Object.BQODu (<anonymous>:1:95774)
at Object.pLXLD (<anonymous>:1:395292)
at Object.UyhhO (<anonymous>:1:404582)
at <anonymous>:1:409830
at 47984 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390223)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78125 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3029625)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78952 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3033069)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 89106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3400082)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 93106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3452584)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 7235 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:277171)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 58200 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1576909)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 86994 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3334892)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6167160
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The event listener that receives the message does not validate the origin.

This was triggered by a message event.

The origin used in the proof of concept was:

https://helpdesk-dev.zalaris.com.fakezalaris.com

The following proof of concept was generated for this issue:

<script>
function poc(){
window.win=window.open('https://helpdesk-dev.zalaris.com/510/tickets/new/phone-benefits');
var msg='';
setTimeout(function(){win.postMessage(msg,'*');}, 5000);
}
</script>
<a href="#" onclick="poc();">PoC</a>

2.6. https://helpdesk-dev.zalaris.com/510/tickets/new/predefined-template
Previous  Next

Summary

	Severity:	Low
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/predefined-template

Issue detail

The application may be vulnerable to DOM-based client-side JSON injection. Data is read from postMessage and passed to JSON.parse.

Request 1

Response 1

Dynamic analysis

Data is read from postMessage and passed to JSON.parse.

The following value was injected into the event handler and reached the sink without any modification:

nmrpft087r%2527%2522`'"/nmrpft087r/><nmrpft087r/\>czj4vrh7ae&

The stack trace at the source was:

at _0x576d9d (<anonymous>:1:418076)

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lfqNk (<anonymous>:1:104147)
at Object.AWngC (<anonymous>:1:438456)
at _0x3fd616.<computed> (<anonymous>:1:463194)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390285
at Object.HSSaF (<anonymous>:1:409571)
at _0x576d9d (<anonymous>:1:419059)

The stack trace at the event listener was:

at Object.BQODu (<anonymous>:1:95774)
at Object.pLXLD (<anonymous>:1:395292)
at Object.UyhhO (<anonymous>:1:404582)
at <anonymous>:1:409830
at 47984 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390223)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78125 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3029625)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78952 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3033069)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 89106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3400082)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 93106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3452584)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 7235 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:277171)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 58200 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1576909)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 86994 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3334892)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6167160
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The event listener that receives the message does not validate the origin.

This was triggered by a message event.

The origin used in the proof of concept was:

https://helpdesk-dev.zalaris.com.fakezalaris.com

The following proof of concept was generated for this issue:

<script>
function poc(){
window.win=window.open('https://helpdesk-dev.zalaris.com/510/tickets/new/predefined-template');
var msg='';
setTimeout(function(){win.postMessage(msg,'*');}, 5000);
}
</script>
<a href="#" onclick="poc();">PoC</a>

2.7. https://helpdesk-dev.zalaris.com/510/tickets/new/test-template-1
Previous  Next

Summary

	Severity:	Low
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/test-template-1

Issue detail

The application may be vulnerable to DOM-based client-side JSON injection. Data is read from postMessage and passed to JSON.parse.

Request 1

Response 1

Dynamic analysis

Data is read from postMessage and passed to JSON.parse.

The following value was injected into the event handler and reached the sink without any modification:

q9jc7pycjg%2527%2522`'"/q9jc7pycjg/><q9jc7pycjg/\>g28b5ng6fn&

The stack trace at the source was:

at _0x576d9d (<anonymous>:1:418076)

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lfqNk (<anonymous>:1:104147)
at Object.AWngC (<anonymous>:1:438456)
at _0x3fd616.<computed> (<anonymous>:1:463194)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390285
at Object.HSSaF (<anonymous>:1:409571)
at _0x576d9d (<anonymous>:1:419059)

The stack trace at the event listener was:

at Object.BQODu (<anonymous>:1:95774)
at Object.pLXLD (<anonymous>:1:395292)
at Object.UyhhO (<anonymous>:1:404582)
at <anonymous>:1:409830
at 47984 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390223)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78125 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3029625)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78952 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3033069)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 89106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3400082)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 93106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3452584)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 7235 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:277171)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 58200 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1576909)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 86994 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3334892)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6167160
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The event listener that receives the message does not validate the origin.

This was triggered by a message event.

The origin used in the proof of concept was:

https://helpdesk-dev.zalaris.com.fakezalaris.com

The following proof of concept was generated for this issue:

<script>
function poc(){
window.win=window.open('https://helpdesk-dev.zalaris.com/510/tickets/new/test-template-1');
var msg='';
setTimeout(function(){win.postMessage(msg,'*');}, 5000);
}
</script>
<a href="#" onclick="poc();">PoC</a>

2.8. https://helpdesk-dev.zalaris.com/510/tickets/new/zalaris-ind
Previous  Next

Summary

	Severity:	Low
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/zalaris-ind

Issue detail

The application may be vulnerable to DOM-based client-side JSON injection. Data is read from postMessage and passed to JSON.parse.

Request 1

Response 1

Dynamic analysis

Data is read from postMessage and passed to JSON.parse.

The following value was injected into the event handler and reached the sink without any modification:

w2up43602w%2527%2522`'"/w2up43602w/><w2up43602w/\>flu62k6z8v&

The stack trace at the source was:

at _0x576d9d (<anonymous>:1:418076)

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lfqNk (<anonymous>:1:104147)
at Object.AWngC (<anonymous>:1:438456)
at _0x3fd616.<computed> (<anonymous>:1:463194)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390285
at Object.HSSaF (<anonymous>:1:409571)
at _0x576d9d (<anonymous>:1:419059)

The stack trace at the event listener was:

at Object.BQODu (<anonymous>:1:95774)
at Object.pLXLD (<anonymous>:1:395292)
at Object.UyhhO (<anonymous>:1:404582)
at <anonymous>:1:409830
at 47984 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390223)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78125 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3029625)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78952 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3033069)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 89106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3400082)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 93106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3452584)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 7235 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:277171)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 58200 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1576909)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 86994 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3334892)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6167160
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The event listener that receives the message does not validate the origin.

This was triggered by a message event.

The origin used in the proof of concept was:

https://helpdesk-dev.zalaris.com.fakezalaris.com

The following proof of concept was generated for this issue:

<script>
function poc(){
window.win=window.open('https://helpdesk-dev.zalaris.com/510/tickets/new/zalaris-ind');
var msg='';
setTimeout(function(){win.postMessage(msg,'*');}, 5000);
}
</script>
<a href="#" onclick="poc();">PoC</a>

2.9. https://helpdesk-dev.zalaris.com/777
Previous  Next

Summary

	Severity:	Low
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/777

Issue detail

The application may be vulnerable to DOM-based client-side JSON injection. Data is read from postMessage and passed to JSON.parse.

Request 1

Response 1

Dynamic analysis

Data is read from postMessage and passed to JSON.parse.

The following value was injected into the event handler and reached the sink without any modification:

ox3s4bqynk%2527%2522`'"/ox3s4bqynk/><ox3s4bqynk/\>y0zwgh73fa&

The stack trace at the source was:

at _0x576d9d (<anonymous>:1:418076)

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lfqNk (<anonymous>:1:104147)
at Object.AWngC (<anonymous>:1:438456)
at _0x3fd616.<computed> (<anonymous>:1:463194)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390285
at Object.HSSaF (<anonymous>:1:409571)
at _0x576d9d (<anonymous>:1:419059)

The stack trace at the event listener was:

at Object.BQODu (<anonymous>:1:95774)
at Object.pLXLD (<anonymous>:1:395292)
at Object.UyhhO (<anonymous>:1:404582)
at <anonymous>:1:409830
at 47984 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390223)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78125 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3029625)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78952 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3033069)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 89106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3400082)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 93106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3452584)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 7235 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:277171)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 58200 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1576909)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 86994 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3334892)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6167160
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The event listener that receives the message does not validate the origin.

This was triggered by a message event.

The origin used in the proof of concept was:

https://helpdesk-dev.zalaris.com.fakezalaris.com

The following proof of concept was generated for this issue:

<script>
function poc(){
window.win=window.open('https://helpdesk-dev.zalaris.com/777');
var msg='';
setTimeout(function(){win.postMessage(msg,'*');}, 5000);
}
</script>
<a href="#" onclick="poc();">PoC</a>

2.10. https://helpdesk-dev.zalaris.com/777/tickets/new/phone-benefits
Previous  Next

Summary

	Severity:	Low
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/777/tickets/new/phone-benefits

Issue detail

The application may be vulnerable to DOM-based client-side JSON injection. Data is read from postMessage and passed to JSON.parse.

Request 1

Response 1

Dynamic analysis

Data is read from postMessage and passed to JSON.parse.

The following value was injected into the event handler and reached the sink without any modification:

welliu1x2z%2527%2522`'"/welliu1x2z/><welliu1x2z/\>hggtnhorx1&

The stack trace at the source was:

at _0x576d9d (<anonymous>:1:418076)

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lfqNk (<anonymous>:1:104147)
at Object.AWngC (<anonymous>:1:438456)
at _0x3fd616.<computed> (<anonymous>:1:463194)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390285
at Object.HSSaF (<anonymous>:1:409571)
at _0x576d9d (<anonymous>:1:419059)

The stack trace at the event listener was:

at Object.BQODu (<anonymous>:1:95774)
at Object.pLXLD (<anonymous>:1:395292)
at Object.UyhhO (<anonymous>:1:404582)
at <anonymous>:1:409830
at 47984 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1390223)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78125 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3029625)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 78952 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3033069)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 89106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3400082)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 93106 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3452584)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 7235 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:277171)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 58200 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:1576909)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at 86994 (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3334892)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3595256)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6167160
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The event listener that receives the message does not validate the origin.

This was triggered by a message event.

The origin used in the proof of concept was:

https://helpdesk-dev.zalaris.com.fakezalaris.com

The following proof of concept was generated for this issue:

<script>
function poc(){
window.win=window.open('https://helpdesk-dev.zalaris.com/777/tickets/new/phone-benefits');
var msg='';
setTimeout(function(){win.postMessage(msg,'*');}, 5000);
}
</script>
<a href="#" onclick="poc();">PoC</a>

3. Open redirection (DOM-based)
Previous  Next

Summary

	Severity:	Low
	Confidence:	Tentative
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/management/links/new

Issue detail

The application may be vulnerable to DOM-based open redirection. Data is read from location.pathname and passed to xhr.send.

Issue background

DOM-based vulnerabilities arise when a client-side script reads data from a controllable part of the DOM (for example, the URL) and processes this data in an unsafe way.

DOM-based open redirection arises when a script writes controllable data into the target of a redirection in an unsafe way. An attacker may be able to use the vulnerability to construct a URL that, if visited by another application user, will cause a redirection to an arbitrary external domain. This behavior can be leveraged to facilitate phishing attacks against users of the application. The ability to use an authentic application URL, targeting the correct domain and with a valid SSL certificate (if SSL is used), lends credibility to the phishing attack because many users, even if they verify these features, will not notice the subsequent redirection to a different domain.

Note: If an attacker is able to control the start of the string that is passed to the redirection API, then it may be possible to escalate this vulnerability into a JavaScript injection attack, by using a URL with the javascript: pseudo-protocol to execute arbitrary script code when the URL is processed by the browser.

Burp Suite automatically identifies this issue using dynamic and static code analysis. Static analysis can lead to false positives that are not actually exploitable. If Burp Scanner has not provided any evidence resulting from dynamic analysis, you should review the relevant code and execution paths to determine whether this vulnerability is indeed present, or whether mitigations are in place that would prevent exploitation.

Issue remediation

The most effective way to avoid DOM-based open redirection vulnerabilities is not to dynamically set redirection targets using data that originated from any untrusted source. If the desired functionality of the application means that this behavior is unavoidable, then defenses must be implemented within the client-side code to prevent malicious data from introducing an arbitrary URL as a redirection target. In general, this is best achieved by using a whitelist of URLs that are permitted redirection targets, and strictly validating the target against this list before performing the redirection.

References

• Web Security Academy: Open redirection (DOM-based)

Vulnerability classifications

• CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to xhr.send.

The following value was injected into the source:

///management/links/new//go6j6qwse9%27%22%60'%22/go6j6qwse9/%3E%3Cgo6j6qwse9//%3Efuvuj75znt&

The previous value reached the sink as:

[{"time":"2025-08-04T05:13:24.366Z","iKey":"56375f0e-24b1-4e3d-af7f-8a8429f358bf","name":"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency","tags":{"ai.user.id":"IlnwffL9PmM+Vnj+5kyZh0","ai.session.id":"ckrfVwZa9203GP3fkUhkfy","ai.device.id":"browser","ai.device.type":"Browser","ai.operation.name":"///management/links/new//go6j6qwse9%27%22%60'%22/go6j6qwse9/%3E%3Cgo6j6qwse9//%3Efuvuj75znt&","ai.operation.id":"5e61f62add4f429391845121549d1fa0","ai.cloud.role":"helpdesk-management-webapp","ai.internal.sdkVersion":"javascript:2.8.16"},"data":{"baseType":"RemoteDependencyData","baseData":{"id":"|5e61f62add4f429391845121549d1fa0.7530b83dce1b4c9c.","ver":2,"name":"GET https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=https://login.microsoftonline.com/a16eb8e2-803d-4f22-849c-f3f335a60a39/oauth2/v2.0/authorize","resultCode":"200","duration":"00:00:00.225","success":true,"data":"GET https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=https://login.microsoftonline.com/a16eb8e2-803d-4f22-849c-f3f335a60a39/oauth2/v2.0/authorize","target":"login.microsoftonline.com","type":"Fetch","properties":{"HttpMethod":"GET"},"measurements":{}}}}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new $C (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3799854)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3801719
at rm (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3699591)
at new e (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3801492)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3803690
at e.initialize (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3803838)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3713121)
at To (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3239563)
at qg (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3713084)
at O (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3776148)
at e.<computed> (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3777906)
at Object.initialize (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3699391)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3781056)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3806873
at Nv (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3708033)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3806756)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3810010
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:5415834
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:5415838

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at _0xdc6a5f.<computed>._0x13cc4d.oknbI._0x3e2633.XMLHttpRequest.<computed> (<anonymous>:1:458938)
at XMLHttpRequest.send (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3736437)
at t.x [as _sender] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3764545)
at e.<computed> [as triggerSend] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3770896)
at t.n [as triggerSend] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at Arguments.<anonymous> (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3766083)
at <anonymous>:1:508906
at _ (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3766048)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3770239)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at r (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716051)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715806
at Nv (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3708033)
at c (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715710)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716061)
at Qg.i.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3714632)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3775120
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3774847)
at To (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3239563)
at r (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3774774)
at Object.processTelemetry (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3775091)
at r (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716051)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715806
at Nv (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3708033)
at c (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715710)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716061)
at Qg.i.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3714632)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3718020)

4. Cookie manipulation (DOM-based)
Previous  Next

There are 3 instances of this issue:

• /510
• /510/tickets/new/generic-form
• /510/tickets/new/phone-benefits

Issue background

DOM-based vulnerabilities arise when a client-side script reads data from a controllable part of the DOM (for example, the URL) and processes this data in an unsafe way.

DOM-based cookie manipulation arises when a script writes controllable data into the value of a cookie. An attacker may be able to use the vulnerability to construct a URL that, if visited by another application user, will set an arbitrary value in the user's cookie.

The potential impact of the vulnerability depends on the role that the cookie plays within the application. If the cookie is used to control the behavior that results from certain user actions (for example, a 'production' versus 'demo' mode setting), then the attacker may be able to cause the user to perform unintended actions by manipulating the cookie's value. If the cookie is used to track the user's session, then the attacker may be able to perform a session fixation attack, in which they set the cookie's value to a valid token that they have obtained from the application, and then hijack the session during the victim user's subsequent interaction with the application.

Burp Suite automatically identifies this issue using dynamic and static code analysis. Static analysis can lead to false positives that are not actually exploitable. If Burp Scanner has not provided any evidence resulting from dynamic analysis, you should review the relevant code and execution paths to determine whether this vulnerability is indeed present, or whether mitigations are in place that would prevent exploitation.

Issue remediation

The most effective way to avoid DOM-based cookie manipulation vulnerabilities is not to dynamically write to cookies using data that originated from any untrusted source. This behavior should never be implemented for cookies that have any role in controlling privileged actions or user sessions within the application.

References

• Web Security Academy: Cookie manipulation (DOM-based)

Vulnerability classifications

• CWE-565: Reliance on Cookies without Validation and Integrity Checking
• CWE-829: Inclusion of Functionality from Untrusted Control Sphere
• CAPEC-31: Accessing/Intercepting/Modifying HTTP Cookies

4.1. https://helpdesk-dev.zalaris.com/510
Previous  Next

Summary

	Severity:	Low
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510

Issue detail

The application may be vulnerable to DOM-based cookie manipulation. Data is read from location.href and passed to document.cookie.

Request 1

Response 1

Dynamic analysis

Data is read from location.href and passed to document.cookie.

The following value was injected into the source:

https://helpdesk-dev.zalaris.com/510?rgddeawzuh=rgddeawzuh%27%22`'"/rgddeawzuh/><rgddeawzuh/\>qqlbpylrvn&#rgddeawzuh=rgddeawzuh%27%22`'"/rgddeawzuh/><rgddeawzuh/\>qqlbpylrvn&

The previous value reached the sink as:

msal.002b5283-fdf4-40c1-aeaa-8c87da51c0ab.request.origin=https%3A%2F%2Fhelpdesk-dev.zalaris.com%2F510%3Frgddeawzuh%3Drgddeawzuh%2527%2522%60'%22%2Frgddeawzuh%2F%3E%3Crgddeawzuh%2F%5C%3Eqqlbpylrvn%26%23rgddeawzuh%3Drgddeawzuh%2527%2522%60'%22%2Frgddeawzuh%2F%3E%3Crgddeawzuh%2F%5C%3Eqqlbpylrvn%26;path=/;SameSite=Lax;Secure;

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get href (<anonymous>:1:249544)
at t.getRedirectStartPage (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4027312)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4020367)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at a (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607640)

The stack trace at the sink was:

at Object.TWPef (<anonymous>:1:111447)
at Object.AaaMx (<anonymous>:1:541530)
at Object.defineProperty.set (<anonymous>:1:551606)
at t.setItemCookie (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3866351)
at t.setTemporaryCache (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3864482)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4016322)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607846
at new Promise (<anonymous>)
at d (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607583)
at t.initiateAuthRequest (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4015995)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4020502)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at a (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607640)

4.2. https://helpdesk-dev.zalaris.com/510/tickets/new/generic-form
Previous  Next

Summary

	Severity:	Low
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/generic-form

Issue detail

The application may be vulnerable to DOM-based cookie manipulation. Data is read from location.href and passed to document.cookie.

Request 1

Response 1

Dynamic analysis

Data is read from location.href and passed to document.cookie.

The following value was injected into the source:

https://helpdesk-dev.zalaris.com/510/tickets/new/generic-form?o79b172cj5=o79b172cj5%27%22`'"/o79b172cj5/><o79b172cj5/\>lhazag84n9&#o79b172cj5=o79b172cj5%27%22`'"/o79b172cj5/><o79b172cj5/\>lhazag84n9&

The previous value reached the sink as:

msal.002b5283-fdf4-40c1-aeaa-8c87da51c0ab.request.origin=https%3A%2F%2Fhelpdesk-dev.zalaris.com%2F510%2Ftickets%2Fnew%2Fgeneric-form%3Fo79b172cj5%3Do79b172cj5%2527%2522%60'%22%2Fo79b172cj5%2F%3E%3Co79b172cj5%2F%5C%3Elhazag84n9%26%23o79b172cj5%3Do79b172cj5%2527%2522%60'%22%2Fo79b172cj5%2F%3E%3Co79b172cj5%2F%5C%3Elhazag84n9%26;path=/;SameSite=Lax;Secure;

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get href (<anonymous>:1:249544)
at t.getRedirectStartPage (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4027312)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4020367)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at a (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607640)

The stack trace at the sink was:

at Object.TWPef (<anonymous>:1:111447)
at Object.AaaMx (<anonymous>:1:541530)
at Object.defineProperty.set (<anonymous>:1:551606)
at t.setItemCookie (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3866351)
at t.setTemporaryCache (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3864482)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4016322)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607846
at new Promise (<anonymous>)
at d (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607583)
at t.initiateAuthRequest (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4015995)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4020502)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at a (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607640)

4.3. https://helpdesk-dev.zalaris.com/510/tickets/new/phone-benefits
Previous  Next

Summary

	Severity:	Low
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/phone-benefits

Issue detail

The application may be vulnerable to DOM-based cookie manipulation. Data is read from location.href and passed to document.cookie.

Request 1

Response 1

Dynamic analysis

Data is read from location.href and passed to document.cookie.

The following value was injected into the source:

https://helpdesk-dev.zalaris.com/510/tickets/new/phone-benefits?h59w0bm2vk=h59w0bm2vk%27%22`'"/h59w0bm2vk/><h59w0bm2vk/\>smed8rzcit&#h59w0bm2vk=h59w0bm2vk%27%22`'"/h59w0bm2vk/><h59w0bm2vk/\>smed8rzcit&

The previous value reached the sink as:

msal.002b5283-fdf4-40c1-aeaa-8c87da51c0ab.request.origin=https%3A%2F%2Fhelpdesk-dev.zalaris.com%2F510%2Ftickets%2Fnew%2Fphone-benefits%3Fh59w0bm2vk%3Dh59w0bm2vk%2527%2522%60'%22%2Fh59w0bm2vk%2F%3E%3Ch59w0bm2vk%2F%5C%3Esmed8rzcit%26%23h59w0bm2vk%3Dh59w0bm2vk%2527%2522%60'%22%2Fh59w0bm2vk%2F%3E%3Ch59w0bm2vk%2F%5C%3Esmed8rzcit%26;path=/;SameSite=Lax;Secure;

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get href (<anonymous>:1:249544)
at t.getRedirectStartPage (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4027312)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4020367)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at a (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607640)

The stack trace at the sink was:

at Object.TWPef (<anonymous>:1:111447)
at Object.AaaMx (<anonymous>:1:541530)
at Object.defineProperty.set (<anonymous>:1:551606)
at t.setItemCookie (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3866351)
at t.setTemporaryCache (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3864482)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4016322)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607846
at new Promise (<anonymous>)
at d (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607583)
at t.initiateAuthRequest (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4015995)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4020502)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at a (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607640)

5. Cross-site scripting (reflected)
Previous  Next

There are 2 instances of this issue:

• /api/v1/tickets [size parameter]
• /api/v1/tickets/549951/entries [filename multipart parameter attribute]

Issue background

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site that causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality that it contains, and the other applications that belong to the same domain and organization. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain that can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organization that owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application and exploiting users' trust in the organization in order to capture credentials for other applications that it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Issue remediation

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defenses:

• Input should be validated as strictly as possible on arrival, given the kind of content that it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitized.
• User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (&lt; &gt; etc).

In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.

References

• Web Security Academy: Cross-site scripting
• Web Security Academy: Reflected cross-site scripting
• Using Burp to Find XSS issues

Vulnerability classifications

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
• CWE-116: Improper Encoding or Escaping of Output
• CWE-159: Failure to Sanitize Special Element
• CAPEC-591: Reflected XSS

5.1. https://helpdesk-dev.zalaris.com/api/v1/tickets [size parameter]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets

Issue detail

The value of the size request parameter is copied into the HTML document as plain text between tags. The payload n782n<script>alert(1)</script>gkegj was submitted in the size parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The response does not state that the content type is HTML. The issue is only directly exploitable if a browser can be made to interpret the response as HTML. No modern browser will interpret the response as HTML. However, the issue might be indirectly exploitable if a client-side script processes the response and embeds it into an HTML context.

Request 1

Response 1

5.2. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [filename multipart parameter attribute]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549951/entries

Issue detail

The value of the filename multipart parameter attribute is copied into the HTML document as plain text between tags. The payload vvcm5<img src=a onerror=alert(1)>qhf0ktsyd9y was submitted in the filename multipart parameter attribute. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The proof-of-concept attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.

The response does not state that the content type is HTML. The issue is only directly exploitable if a browser can be made to interpret the response as HTML. No modern browser will interpret the response as HTML. However, the issue might be indirectly exploitable if a client-side script processes the response and embeds it into an HTML context.

Request 1

Response 1

6. External service interaction (DNS)
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510

Issue detail

It is possible to induce the application to perform server-side DNS lookups of arbitrary domain names.

The payload seabk60cg913petbj5zua2hh1871vsjli98wykn.oastify.com was submitted in the SSL SNI value and the HTTP Host header.

The application performed a DNS lookup of the specified domain.

Issue background

The ability to induce an application to interact with an arbitrary external service, such as a web or mail server, does not constitute a vulnerability in its own right. This might even be the intended behavior of the application. However, in some cases, it can indicate a vulnerability with serious consequences.

If you can trigger DNS-based interactions, it is normally possible to trigger interactions using other service types. Burp Scanner reports these as separate issues. You may find that a payload, such as a URL, only triggers a DNS-based interaction, even though you were expecting interactions with a different service as well. This could be due to egress filters on the network layer that prevent the application from connecting to these other services. However, some systems perform DNS lookups without any intention of connecting to the remote host. This behavior is typically harmless.

The ability to send requests to other systems can allow the vulnerable server to be used as an attack proxy. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with. This may include public third-party systems, internal systems within the same organization, or services available on the local loopback adapter of the application server itself. Depending on the network architecture, this may expose highly vulnerable internal services that are not otherwise accessible to external attackers.

Issue remediation

You should review the purpose and intended use of the relevant application functionality, and determine whether the ability to trigger arbitrary external service interactions is intended behavior. If so, you should be aware of the types of attacks that can be performed via this behavior and take appropriate measures. These measures might include blocking network access from the application server to other internal systems, and hardening the application server itself to remove any services available on the local loopback adapter.

If the ability to trigger arbitrary external service interactions is not intended behavior, then you should implement a whitelist of permitted services and hosts, and block any interactions that do not appear on this whitelist.

Out-of-Band Application Security Testing (OAST) is highly effective at uncovering high-risk features, to the point where finding the root cause of an interaction can be quite challenging. To find the source of an external service interaction, try to identify whether it is triggered by specific application functionality, or occurs indiscriminately on all requests. If it occurs on all endpoints, a front-end CDN or application firewall may be responsible, or a back-end analytics system parsing server logs. In some cases, interactions may originate from third-party systems; for example, a HTTP request may trigger a poisoned email which passes through a link-scanner on its way to the recipient.

References

• Burp Collaborator
• Out-of-band application security testing (OAST)
• PortSwigger Research: Cracking the Lens

Vulnerability classifications

• CWE-918: Server-Side Request Forgery (SSRF)
• CWE-406: Insufficient Control of Network Message Volume (Network Amplification)

Request 1

Response 1

Collaborator DNS interaction

The Collaborator server received a DNS lookup of type AAAA for the domain name seabk60cg913petbj5zua2hh1871vsjli98wykn.oastify.com.

The lookup was received from IP address 67.215.80.135:52655 at 2025-Aug-04 05:21:13.321 UTC. 7. User agent-dependent response
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/locales/en-US/locale.json

Issue description

Application responses may depend systematically on the value of the User-Agent header in requests. This behavior does not itself constitute a security vulnerability, but may point towards additional attack surface within the application, which may contain vulnerabilities.

This behavior often arises because applications provide different user interfaces for desktop and mobile users. Mobile interfaces have often been less thoroughly tested for vulnerabilities such as cross-site scripting, and often have simpler authentication and session handling mechanisms that may contain problems that are not present in the full interface.

To review the interface provided by the alternate User-Agent header, you can configure a match/replace rule in Burp Proxy to modify the User-Agent header in all requests, and then browse the application in the normal way using your normal browser.

Vulnerability classifications

• CWE-16: Configuration

Request 1

Response 1

Request 2

Response 2

8. Input returned in response (stored)
Previous  Next

There are 10 instances of this issue:

• /api/v1/drafts [categoryId JSON parameter]
• /api/v1/drafts [subject JSON parameter]
• /api/v1/drafts [templateId JSON parameter]
• /api/v1/tickets/549830/feedback [text JSON parameter]
• /api/v1/tickets/549951/entries [p XML parameter within the text parameter]
• /api/v1/tickets/549951/entries [p XML parameter within the text parameter]
• /api/v1/tickets/549951/entries [text parameter]
• /api/v1/tickets/549951/entries [text parameter]
• /api/v1/tickets/549951/resolve [text JSON parameter]
• /api/v1/tickets/549951/resolve [text JSON parameter]

Issue background

Retrieval of stored input arises when user input is stored and later embedded into the application's responses.

Input being returned in application responses is not a vulnerability in its own right. However, it is a prerequisite for many client-side vulnerabilities, including cross-site scripting, open redirection, content spoofing, and response header injection. Additionally, some server-side vulnerabilities such as SQL injection are often easier to identify and exploit when input is returned in responses. In applications where input retrieval is rare and the environment is resistant to automated testing (for example, due to a web application firewall), it might be worth subjecting instances of it to focused manual testing.

Vulnerabilities resulting from retrieval of stored input are typically more serious than the equivalent reflected vulnerabilities because they do not require a separate delivery mechanism in order to reach target users. Depending on the affected functionality, ordinary users may be exploited during normal use of the application. Note that automated detection of stored data retrieval cannot reliably determine whether input that is persisted within the application can be retrieved by any other user, only by authenticated users, or only by the attacker themselves. You should review the functionality in which the vulnerability appears to determine whether the application's behavior can feasibly be used to compromise other application users.

Vulnerability classifications

• CWE-20: Improper Input Validation
• CWE-116: Improper Encoding or Escaping of Output

8.1. https://helpdesk-dev.zalaris.com/api/v1/drafts [categoryId JSON parameter]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts

Issue detail

The value of the categoryId JSON parameter submitted to the URL /api/v1/drafts is copied into the response for the URL /api/v1/drafts.

Burp has captured the first observed location where this stored input is returned. There might be other locations within the application where the same input is returned. To identify all such locations, perform a full crawl of the application and then do a global search for the highlighted value.

Request 1

Request 2

Response 2

8.2. https://helpdesk-dev.zalaris.com/api/v1/drafts [subject JSON parameter]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts

Issue detail

The value of the subject JSON parameter submitted to the URL /api/v1/drafts is copied into the response for the URL /api/v1/drafts.

Burp has captured the first observed location where this stored input is returned. There might be other locations within the application where the same input is returned. To identify all such locations, perform a full crawl of the application and then do a global search for the highlighted value.

Request 1

Request 2

Response 2

8.3. https://helpdesk-dev.zalaris.com/api/v1/drafts [templateId JSON parameter]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts

Issue detail

The value of the templateId JSON parameter submitted to the URL /api/v1/drafts is copied into the response for the URL /api/v1/drafts.

Burp has captured the first observed location where this stored input is returned. There might be other locations within the application where the same input is returned. To identify all such locations, perform a full crawl of the application and then do a global search for the highlighted value.

Request 1

Request 2

Response 2

8.4. https://helpdesk-dev.zalaris.com/api/v1/tickets/549830/feedback [text JSON parameter]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549830/feedback

Issue detail

The value of the text JSON parameter submitted to the URL /api/v1/tickets/549830/feedback is copied into the response for the URL /api/v1/tickets/549830.

Burp has captured the first observed location where this stored input is returned. There might be other locations within the application where the same input is returned. To identify all such locations, perform a full crawl of the application and then do a global search for the highlighted value.

Request 1

Request 2

Response 2

8.5. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [p XML parameter within the text parameter]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549951/entries

Issue detail

The value of the p XML parameter within the text parameter submitted to the URL /api/v1/tickets/549951/entries is copied into the response for the URL /api/v1/tickets/byDraft/8b8eb30dc69941c19f8d7c99984cb28d.

Burp has captured the first observed location where this stored input is returned. There might be other locations within the application where the same input is returned. To identify all such locations, perform a full crawl of the application and then do a global search for the highlighted value.

Request 1

Request 2

Response 2

8.6. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [p XML parameter within the text parameter]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549951/entries

Issue detail

The value of the p XML parameter within the text parameter submitted to the URL /api/v1/tickets/549951/entries is copied into the response for the URL /api/v1/tickets/549951.

Burp has captured the first observed location where this stored input is returned. There might be other locations within the application where the same input is returned. To identify all such locations, perform a full crawl of the application and then do a global search for the highlighted value.

Request 1

Request 2

Response 2

8.7. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [text parameter]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549951/entries

Issue detail

The value of the text request parameter submitted to the URL /api/v1/tickets/549951/entries is copied into the response for the URL /api/v1/tickets/byDraft/8b8eb30dc69941c19f8d7c99984cb28d.

Burp has captured the first observed location where this stored input is returned. There might be other locations within the application where the same input is returned. To identify all such locations, perform a full crawl of the application and then do a global search for the highlighted value.

Request 1

Request 2

Response 2

8.8. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [text parameter]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549951/entries

Issue detail

The value of the text request parameter submitted to the URL /api/v1/tickets/549951/entries is copied into the response for the URL /api/v1/tickets/549951.

Burp has captured the first observed location where this stored input is returned. There might be other locations within the application where the same input is returned. To identify all such locations, perform a full crawl of the application and then do a global search for the highlighted value.

Request 1

Request 2

Response 2

8.9. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/resolve [text JSON parameter]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549951/resolve

Issue detail

The value of the text JSON parameter submitted to the URL /api/v1/tickets/549951/resolve is copied into the response for the URL /api/v1/tickets/byDraft/8b8eb30dc69941c19f8d7c99984cb28d.

Burp has captured the first observed location where this stored input is returned. There might be other locations within the application where the same input is returned. To identify all such locations, perform a full crawl of the application and then do a global search for the highlighted value.

Request 1

Request 2

Response 2

8.10. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/resolve [text JSON parameter]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549951/resolve

Issue detail

The value of the text JSON parameter submitted to the URL /api/v1/tickets/549951/resolve is copied into the response for the URL /api/v1/tickets/549951.

Burp has captured the first observed location where this stored input is returned. There might be other locations within the application where the same input is returned. To identify all such locations, perform a full crawl of the application and then do a global search for the highlighted value.

Request 1

Request 2

Response 2

9. Input returned in response (reflected)
Previous  Next

There are 51 instances of this issue:

• /api/v1/cms/notes [URL path filename]
• /api/v1/cms/notes [URL path folder 2]
• /api/v1/cms/notes [URL path folder 3]
• /api/v1/cms/updates [URL path filename]
• /api/v1/cms/updates [URL path folder 3]
• /api/v1/contacts/authenticatedUser [URL path filename]
• /api/v1/contacts/authenticatedUser [URL path folder 3]
• /api/v1/drafts [URL path filename]
• /api/v1/drafts [URL path folder 2]
• /api/v1/drafts/2e5e5387853243a4862aa6b212f30e87 [URL path filename]
• /api/v1/drafts/2e5e5387853243a4862aa6b212f30e87 [URL path folder 2]
• /api/v1/drafts/2e5e5387853243a4862aa6b212f30e87 [URL path folder 3]
• /api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files [URL path filename]
• /api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files [URL path folder 2]
• /api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files [URL path folder 3]
• /api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files [URL path folder 4]
• /api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/submit [URL path filename]
• /api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/submit [URL path folder 4]
• /api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d [URL path filename]
• /api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d [URL path folder 2]
• /api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d [URL path folder 3]
• /api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit [URL path filename]
• /api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit [URL path folder 2]
• /api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit [URL path folder 3]
• /api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit [URL path folder 4]
• /api/v1/notifications [URL path filename]
• /api/v1/notifications [URL path folder 2]
• /api/v1/templates/categories [URL path filename]
• /api/v1/templates/categories [URL path folder 3]
• /api/v1/templates/slug/phone-benefits [URL path folder 3]
• /api/v1/templates/slug/phone-benefits [URL path folder 4]
• /api/v1/tickets [size parameter]
• /api/v1/tickets/549830 [URL path filename]
• /api/v1/tickets/549830 [URL path folder 3]
• /api/v1/tickets/549830/feedback [URL path filename]
• /api/v1/tickets/549830/feedback [URL path folder 2]
• /api/v1/tickets/549830/feedback [URL path folder 3]
• /api/v1/tickets/549830/feedback [URL path folder 4]
• /api/v1/tickets/549849 [URL path filename]
• /api/v1/tickets/549849 [URL path folder 3]
• /api/v1/tickets/549951 [URL path folder 3]
• /api/v1/tickets/549951/entries [URL path filename]
• /api/v1/tickets/549951/entries [URL path folder 4]
• /api/v1/tickets/549951/entries [filename multipart parameter attribute]
• /api/v1/tickets/549951/resolve [URL path filename]
• /api/v1/tickets/549951/resolve [URL path folder 3]
• /api/v1/tickets/549951/resolve [URL path folder 4]
• /api/v1/tickets/byDraft/2e5e5387853243a4862aa6b212f30e87 [URL path filename]
• /api/v1/tickets/byDraft/2e5e5387853243a4862aa6b212f30e87 [URL path folder 4]
• /api/v1/tickets/byDraft/8b8eb30dc69941c19f8d7c99984cb28d [URL path filename]
• /api/v1/tickets/byDraft/8b8eb30dc69941c19f8d7c99984cb28d [URL path folder 4]

Issue background

Reflection of input arises when data is copied from a request and echoed into the application's immediate response.

Input being returned in application responses is not a vulnerability in its own right. However, it is a prerequisite for many client-side vulnerabilities, including cross-site scripting, open redirection, content spoofing, and response header injection. Additionally, some server-side vulnerabilities such as SQL injection are often easier to identify and exploit when input is returned in responses. In applications where input retrieval is rare and the environment is resistant to automated testing (for example, due to a web application firewall), it might be worth subjecting instances of it to focused manual testing.

Vulnerability classifications

• CWE-20: Improper Input Validation
• CWE-116: Improper Encoding or Escaping of Output

9.1. https://helpdesk-dev.zalaris.com/api/v1/cms/notes [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/cms/notes

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.2. https://helpdesk-dev.zalaris.com/api/v1/cms/notes [URL path folder 2]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/cms/notes

Issue detail

The value of the URL path folder 2 is copied into the application's response.

Request 1

Response 1

9.3. https://helpdesk-dev.zalaris.com/api/v1/cms/notes [URL path folder 3]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/cms/notes

Issue detail

The value of the URL path folder 3 is copied into the application's response.

Request 1

Response 1

9.4. https://helpdesk-dev.zalaris.com/api/v1/cms/updates [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/cms/updates

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.5. https://helpdesk-dev.zalaris.com/api/v1/cms/updates [URL path folder 3]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/cms/updates

Issue detail

The value of the URL path folder 3 is copied into the application's response.

Request 1

Response 1

9.6. https://helpdesk-dev.zalaris.com/api/v1/contacts/authenticatedUser [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/contacts/authenticatedUser

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.7. https://helpdesk-dev.zalaris.com/api/v1/contacts/authenticatedUser [URL path folder 3]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/contacts/authenticatedUser

Issue detail

The value of the URL path folder 3 is copied into the application's response.

Request 1

Response 1

9.8. https://helpdesk-dev.zalaris.com/api/v1/drafts [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.9. https://helpdesk-dev.zalaris.com/api/v1/drafts [URL path folder 2]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts

Issue detail

The value of the URL path folder 2 is copied into the application's response.

Request 1

Response 1

9.10. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87 [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.11. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87 [URL path folder 2]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87

Issue detail

The value of the URL path folder 2 is copied into the application's response.

Request 1

Response 1

9.12. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87 [URL path folder 3]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87

Issue detail

The value of the URL path folder 3 is copied into the application's response.

Request 1

Response 1

9.13. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.14. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files [URL path folder 2]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files

Issue detail

The value of the URL path folder 2 is copied into the application's response.

Request 1

Response 1

9.15. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files [URL path folder 3]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files

Issue detail

The value of the URL path folder 3 is copied into the application's response.

Request 1

Response 1

9.16. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files [URL path folder 4]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/files

Issue detail

The value of the URL path folder 4 is copied into the application's response.

Request 1

Response 1

9.17. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/submit [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/submit

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.18. https://helpdesk-dev.zalaris.com/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/submit [URL path folder 4]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/2e5e5387853243a4862aa6b212f30e87/submit

Issue detail

The value of the URL path folder 4 is copied into the application's response.

Request 1

Response 1

9.19. https://helpdesk-dev.zalaris.com/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.20. https://helpdesk-dev.zalaris.com/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d [URL path folder 2]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d

Issue detail

The value of the URL path folder 2 is copied into the application's response.

Request 1

Response 1

9.21. https://helpdesk-dev.zalaris.com/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d [URL path folder 3]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d

Issue detail

The value of the URL path folder 3 is copied into the application's response.

Request 1

Response 1

9.22. https://helpdesk-dev.zalaris.com/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.23. https://helpdesk-dev.zalaris.com/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit [URL path folder 2]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit

Issue detail

The value of the URL path folder 2 is copied into the application's response.

Request 1

Response 1

9.24. https://helpdesk-dev.zalaris.com/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit [URL path folder 3]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit

Issue detail

The value of the URL path folder 3 is copied into the application's response.

Request 1

Response 1

9.25. https://helpdesk-dev.zalaris.com/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit [URL path folder 4]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/drafts/8b8eb30dc69941c19f8d7c99984cb28d/submit

Issue detail

The value of the URL path folder 4 is copied into the application's response.

Request 1

Response 1

9.26. https://helpdesk-dev.zalaris.com/api/v1/notifications [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/notifications

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.27. https://helpdesk-dev.zalaris.com/api/v1/notifications [URL path folder 2]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/notifications

Issue detail

The value of the URL path folder 2 is copied into the application's response.

Request 1

Response 1

9.28. https://helpdesk-dev.zalaris.com/api/v1/templates/categories [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/templates/categories

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.29. https://helpdesk-dev.zalaris.com/api/v1/templates/categories [URL path folder 3]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/templates/categories

Issue detail

The value of the URL path folder 3 is copied into the application's response.

Request 1

Response 1

9.30. https://helpdesk-dev.zalaris.com/api/v1/templates/slug/phone-benefits [URL path folder 3]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/templates/slug/phone-benefits

Issue detail

The value of the URL path folder 3 is copied into the application's response.

Request 1

Response 1

9.31. https://helpdesk-dev.zalaris.com/api/v1/templates/slug/phone-benefits [URL path folder 4]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/templates/slug/phone-benefits

Issue detail

The value of the URL path folder 4 is copied into the application's response.

Request 1

Response 1

9.32. https://helpdesk-dev.zalaris.com/api/v1/tickets [size parameter]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets

Issue detail

The value of the size request parameter is copied into the application's response.

Request 1

Response 1

9.33. https://helpdesk-dev.zalaris.com/api/v1/tickets/549830 [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549830

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.34. https://helpdesk-dev.zalaris.com/api/v1/tickets/549830 [URL path folder 3]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549830

Issue detail

The value of the URL path folder 3 is copied into the application's response.

Request 1

Response 1

9.35. https://helpdesk-dev.zalaris.com/api/v1/tickets/549830/feedback [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549830/feedback

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.36. https://helpdesk-dev.zalaris.com/api/v1/tickets/549830/feedback [URL path folder 2]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549830/feedback

Issue detail

The value of the URL path folder 2 is copied into the application's response.

Request 1

Response 1

9.37. https://helpdesk-dev.zalaris.com/api/v1/tickets/549830/feedback [URL path folder 3]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549830/feedback

Issue detail

The value of the URL path folder 3 is copied into the application's response.

Request 1

Response 1

9.38. https://helpdesk-dev.zalaris.com/api/v1/tickets/549830/feedback [URL path folder 4]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549830/feedback

Issue detail

The value of the URL path folder 4 is copied into the application's response.

Request 1

Response 1

9.39. https://helpdesk-dev.zalaris.com/api/v1/tickets/549849 [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549849

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.40. https://helpdesk-dev.zalaris.com/api/v1/tickets/549849 [URL path folder 3]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549849

Issue detail

The value of the URL path folder 3 is copied into the application's response.

Request 1

Response 1

9.41. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951 [URL path folder 3]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549951

Issue detail

The value of the URL path folder 3 is copied into the application's response.

Request 1

Response 1

9.42. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549951/entries

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.43. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [URL path folder 4]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549951/entries

Issue detail

The value of the URL path folder 4 is copied into the application's response.

Request 1

Response 1

9.44. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/entries [filename multipart parameter attribute]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549951/entries

Issue detail

The value of the filename multipart parameter attribute is copied into the application's response.

Request 1

Response 1

9.45. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/resolve [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549951/resolve

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.46. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/resolve [URL path folder 3]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549951/resolve

Issue detail

The value of the URL path folder 3 is copied into the application's response.

Request 1

Response 1

9.47. https://helpdesk-dev.zalaris.com/api/v1/tickets/549951/resolve [URL path folder 4]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/549951/resolve

Issue detail

The value of the URL path folder 4 is copied into the application's response.

Request 1

Response 1

9.48. https://helpdesk-dev.zalaris.com/api/v1/tickets/byDraft/2e5e5387853243a4862aa6b212f30e87 [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/byDraft/2e5e5387853243a4862aa6b212f30e87

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.49. https://helpdesk-dev.zalaris.com/api/v1/tickets/byDraft/2e5e5387853243a4862aa6b212f30e87 [URL path folder 4]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/byDraft/2e5e5387853243a4862aa6b212f30e87

Issue detail

The value of the URL path folder 4 is copied into the application's response.

Request 1

Response 1

9.50. https://helpdesk-dev.zalaris.com/api/v1/tickets/byDraft/8b8eb30dc69941c19f8d7c99984cb28d [URL path filename]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/byDraft/8b8eb30dc69941c19f8d7c99984cb28d

Issue detail

The value of the URL path filename is copied into the application's response.

Request 1

Response 1

9.51. https://helpdesk-dev.zalaris.com/api/v1/tickets/byDraft/8b8eb30dc69941c19f8d7c99984cb28d [URL path folder 4]
Previous  Next

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/api/v1/tickets/byDraft/8b8eb30dc69941c19f8d7c99984cb28d

Issue detail

The value of the URL path folder 4 is copied into the application's response.

Request 1

Response 1

10. Frameable response (potential Clickjacking)
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/

Issue detail

This issue was found in multiple locations under the reported path.

Issue background

If a page fails to set an appropriate X-Frame-Options or Content-Security-Policy HTTP header, it might be possible for a page controlled by an attacker to load it within an iframe. This may enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. By inducing victim users to perform actions such as mouse clicks and keystrokes, the attacker can cause them to unwittingly carry out actions within the application that is being targeted. This technique allows the attacker to circumvent defenses against cross-site request forgery, and may result in unauthorized actions.

Note that some applications attempt to prevent these attacks from within the HTML page itself, using "framebusting" code. However, this type of defense is normally ineffective and can usually be circumvented by a skilled attacker.

You should determine whether any functions accessible within frameable pages can be used by application users to perform any sensitive actions within the application.

Issue remediation

To effectively prevent framing attacks, the application should return a response header with the name X-Frame-Options and the value DENY to prevent framing altogether, or the value SAMEORIGIN to allow framing only by pages on the same origin as the response itself. Note that the SAMEORIGIN header can be partially bypassed if the application itself can be made to frame untrusted websites.

References

• Web Security Academy: Clickjacking
• X-Frame-Options

Vulnerability classifications

• CWE-693: Protection Mechanism Failure
• CWE-1021: Improper Restriction of Rendered UI Layers or Frames
• CAPEC-103: Clickjacking

Request 1

Response 1

Request 2

Response 2

Request 3

Response 3

11. HTML5 storage manipulation (DOM-based)
Previous  Next

There are 26 instances of this issue:

• /
• /
• /510
• /510
• /510
• /510/tickets/new/duplicate-test
• /510/tickets/new/duplicate-test
• /510/tickets/new/generic-form
• /510/tickets/new/generic-form
• /510/tickets/new/generic-form
• /510/tickets/new/phone-benefits
• /510/tickets/new/phone-benefits
• /510/tickets/new/phone-benefits
• /510/tickets/new/predefined-template
• /510/tickets/new/predefined-template
• /510/tickets/new/test-template-1
• /510/tickets/new/test-template-1
• /510/tickets/new/zalaris-ind
• /510/tickets/new/zalaris-ind
• /777
• /777
• /777/tickets/new/phone-benefits
• /777/tickets/new/phone-benefits
• /management/links/new
• /management/links/new
• /management/links/new

Issue background

DOM-based vulnerabilities arise when a client-side script reads data from a controllable part of the DOM (for example, the URL) and processes this data in an unsafe way.

HTML5 storage manipulation arises when a script stores controllable data in the HTML5 storage of the web browser (either localStorage or sessionStorage). An attacker may be able to use this behavior to construct a URL that, if visited by another application user, will cause the user's browser to store attacker-controllable data.

This behavior does not in itself constitute a security vulnerability. However, if the application later reads the data back from storage and processes it in an unsafe way, then an attacker may be able to leverage the storage mechanism to deliver other DOM-based attacks, such as cross-site scripting and JavaScript injection.

Burp Suite automatically identifies this issue using dynamic and static code analysis. Static analysis can lead to false positives that are not actually exploitable. If Burp Scanner has not provided any evidence resulting from dynamic analysis, you should review the relevant code and execution paths to determine whether this vulnerability is indeed present, or whether mitigations are in place that would prevent exploitation.

Issue remediation

The most effective way to avoid DOM-based HTML5 storage manipulation is not to place in HTML5 storage any data that originated from any untrusted source. If the desired functionality of the application means that this behavior is unavoidable, then defenses must be implemented within the client-side code to prevent malicious data from being stored.

References

• Web Security Academy: HTML5 storage manipulation (DOM-based)

Vulnerability classifications

• CWE-20: Improper Input Validation
• CAPEC-153: Input Data Manipulation

11.1. https://helpdesk-dev.zalaris.com/
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

/////vu9u9uauaw%27%22%60'%22/vu9u9uauaw/%3E%3Cvu9u9uauaw//%3El3te4edvkz&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:08.746Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"hDVTDy/clMQqxV9kD4hQdZ\",\"ai.session.id\":\"7c+iXyQRrZc40TfAgliSXH\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"/////vu9u9uauaw%27%22%60'%22/vu9u9uauaw/%3E%3Cvu9u9uauaw//%3El3te4edvkz&\",\"ai.operation.id\":\"0fa255d3584e4f5b9b43d9231fd6f690\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|0fa255d3584e4f5b9b43d9231fd6f690.c858249252974bc5.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"404\",\"duration\":\"00:00:02.451\",\"success\":false,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0},{"item":"{\"time\":\"2025-08-04T05:13:08.991Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"hDVTDy/clMQqxV9kD4hQdZ\",\"ai.session.id\":\"7c+iXyQRrZc40TfAgliSXH\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"/////vu9u9uauaw%27%22%60'%22/vu9u9uauaw/%3E%3Cvu9u9uauaw//%3El3te4edvkz&\",\"ai.operation.id\":\"0fa255d3584e4f5b9b43d9231fd6f690\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|0fa255d3584e4f5b9b43d9231fd6f690.d215f8eca9c745a0.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:02.666\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)

11.2. https://helpdesk-dev.zalaris.com/
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

/////vu9u9uauaw%27%22%60'%22/vu9u9uauaw/%3E%3Cvu9u9uauaw//%3El3te4edvkz&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:08.746Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"hDVTDy/clMQqxV9kD4hQdZ\",\"ai.session.id\":\"7c+iXyQRrZc40TfAgliSXH\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"/////vu9u9uauaw%27%22%60'%22/vu9u9uauaw/%3E%3Cvu9u9uauaw//%3El3te4edvkz&\",\"ai.operation.id\":\"0fa255d3584e4f5b9b43d9231fd6f690\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|0fa255d3584e4f5b9b43d9231fd6f690.c858249252974bc5.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"404\",\"duration\":\"00:00:02.451\",\"success\":false,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at t.n [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)

11.3. https://helpdesk-dev.zalaris.com/510
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.href and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.href and passed to sessionStorage.setItem.value.

The following value was injected into the source and reached the sink without any modification:

https://helpdesk-dev.zalaris.com/510?rgddeawzuh=rgddeawzuh%27%22`'"/rgddeawzuh/><rgddeawzuh/\>qqlbpylrvn&#rgddeawzuh=rgddeawzuh%27%22`'"/rgddeawzuh/><rgddeawzuh/\>qqlbpylrvn&

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get href (<anonymous>:1:249544)
at t.getRedirectStartPage (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4027312)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4020367)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at a (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607640)

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at e.setItem (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3842493)
at t.setTemporaryCache (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3864306)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4016322)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607846
at new Promise (<anonymous>)
at d (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607583)
at t.initiateAuthRequest (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4015995)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4020502)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at a (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607640)

11.4. https://helpdesk-dev.zalaris.com/510
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///510//l66ojpa21i%27%22%60'%22/l66ojpa21i/%3E%3Cl66ojpa21i//%3Ej5bav0a4gk&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:02.746Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"NwwWVR3nHUJYKQKzuQlCOw\",\"ai.session.id\":\"q+rFP4LT7FAnRy9Uh9TQDJ\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510//l66ojpa21i%27%22%60'%22/l66ojpa21i/%3E%3Cl66ojpa21i//%3Ej5bav0a4gk&\",\"ai.operation.id\":\"ba2f4817d09a497086801d237f9aec37\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|ba2f4817d09a497086801d237f9aec37.5fa2f295bac44f48.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:01.634\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0},{"item":"{\"time\":\"2025-08-04T05:13:02.688Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"NwwWVR3nHUJYKQKzuQlCOw\",\"ai.session.id\":\"q+rFP4LT7FAnRy9Uh9TQDJ\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510//l66ojpa21i%27%22%60'%22/l66ojpa21i/%3E%3Cl66ojpa21i//%3Ej5bav0a4gk&\",\"ai.operation.id\":\"ba2f4817d09a497086801d237f9aec37\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|ba2f4817d09a497086801d237f9aec37.3679539f1bfc4487.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"404\",\"duration\":\"00:00:01.920\",\"success\":false,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)

11.5. https://helpdesk-dev.zalaris.com/510
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///510//l66ojpa21i%27%22%60'%22/l66ojpa21i/%3E%3Cl66ojpa21i//%3Ej5bav0a4gk&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:02.746Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"NwwWVR3nHUJYKQKzuQlCOw\",\"ai.session.id\":\"q+rFP4LT7FAnRy9Uh9TQDJ\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510//l66ojpa21i%27%22%60'%22/l66ojpa21i/%3E%3Cl66ojpa21i//%3Ej5bav0a4gk&\",\"ai.operation.id\":\"ba2f4817d09a497086801d237f9aec37\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|ba2f4817d09a497086801d237f9aec37.5fa2f295bac44f48.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:01.634\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at t.n [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)

11.6. https://helpdesk-dev.zalaris.com/510/tickets/new/duplicate-test
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/duplicate-test

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///510/tickets/new/duplicate-test//q4t5nyxnlq%27%22%60'%22/q4t5nyxnlq/%3E%3Cq4t5nyxnlq//%3Ejoapl13rgn&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:16.910Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"iE+b/344cp3853PrzhUf9A\",\"ai.session.id\":\"EFNoN+9Og4+Ehz+KhJj9eo\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/duplicate-test//q4t5nyxnlq%27%22%60'%22/q4t5nyxnlq/%3E%3Cq4t5nyxnlq//%3Ejoapl13rgn&\",\"ai.operation.id\":\"67efeb56c64d40f0a0f4187e9e71fcbd\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|67efeb56c64d40f0a0f4187e9e71fcbd.f3251b702d7144b4.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"404\",\"duration\":\"00:00:01.040\",\"success\":false,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at t.n [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)

11.7. https://helpdesk-dev.zalaris.com/510/tickets/new/duplicate-test
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/duplicate-test

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///510/tickets/new/duplicate-test//q4t5nyxnlq%27%22%60'%22/q4t5nyxnlq/%3E%3Cq4t5nyxnlq//%3Ejoapl13rgn&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:16.910Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"iE+b/344cp3853PrzhUf9A\",\"ai.session.id\":\"EFNoN+9Og4+Ehz+KhJj9eo\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/duplicate-test//q4t5nyxnlq%27%22%60'%22/q4t5nyxnlq/%3E%3Cq4t5nyxnlq//%3Ejoapl13rgn&\",\"ai.operation.id\":\"67efeb56c64d40f0a0f4187e9e71fcbd\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|67efeb56c64d40f0a0f4187e9e71fcbd.f3251b702d7144b4.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"404\",\"duration\":\"00:00:01.040\",\"success\":false,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0},{"item":"{\"time\":\"2025-08-04T05:13:16.979Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"iE+b/344cp3853PrzhUf9A\",\"ai.session.id\":\"EFNoN+9Og4+Ehz+KhJj9eo\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/duplicate-test//q4t5nyxnlq%27%22%60'%22/q4t5nyxnlq/%3E%3Cq4t5nyxnlq//%3Ejoapl13rgn&\",\"ai.operation.id\":\"67efeb56c64d40f0a0f4187e9e71fcbd\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|67efeb56c64d40f0a0f4187e9e71fcbd.86831477d27c456d.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:01.152\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)

11.8. https://helpdesk-dev.zalaris.com/510/tickets/new/generic-form
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/generic-form

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.href and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.href and passed to sessionStorage.setItem.value.

The following value was injected into the source and reached the sink without any modification:

https://helpdesk-dev.zalaris.com/510/tickets/new/generic-form?o79b172cj5=o79b172cj5%27%22`'"/o79b172cj5/><o79b172cj5/\>lhazag84n9&#o79b172cj5=o79b172cj5%27%22`'"/o79b172cj5/><o79b172cj5/\>lhazag84n9&

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get href (<anonymous>:1:249544)
at t.getRedirectStartPage (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4027312)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4020367)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at a (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607640)

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at e.setItem (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3842493)
at t.setTemporaryCache (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3864306)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4016322)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607846
at new Promise (<anonymous>)
at d (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607583)
at t.initiateAuthRequest (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4015995)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4020502)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at a (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607640)

11.9. https://helpdesk-dev.zalaris.com/510/tickets/new/generic-form
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/generic-form

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///510/tickets/new/generic-form//f0swso6qtw%27%22%60'%22/f0swso6qtw/%3E%3Cf0swso6qtw//%3Eap4bvz36c0&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:02.868Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"qLRM59yYNeECySsCMATby1\",\"ai.session.id\":\"YOcLuDMIFlduS+5pMUKYZI\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/generic-form//f0swso6qtw%27%22%60'%22/f0swso6qtw/%3E%3Cf0swso6qtw//%3Eap4bvz36c0&\",\"ai.operation.id\":\"d5e13cdc95924effb8a04f03c0c336da\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|d5e13cdc95924effb8a04f03c0c336da.6477a9aaf1b94597.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:01.505\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0},{"item":"{\"time\":\"2025-08-04T05:13:02.826Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"qLRM59yYNeECySsCMATby1\",\"ai.session.id\":\"YOcLuDMIFlduS+5pMUKYZI\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/generic-form//f0swso6qtw%27%22%60'%22/f0swso6qtw/%3E%3Cf0swso6qtw//%3Eap4bvz36c0&\",\"ai.operation.id\":\"d5e13cdc95924effb8a04f03c0c336da\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|d5e13cdc95924effb8a04f03c0c336da.65a1a832505d4fc8.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"404\",\"duration\":\"00:00:02.024\",\"success\":false,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)

11.10. https://helpdesk-dev.zalaris.com/510/tickets/new/generic-form
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/generic-form

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///510/tickets/new/generic-form//f0swso6qtw%27%22%60'%22/f0swso6qtw/%3E%3Cf0swso6qtw//%3Eap4bvz36c0&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:02.868Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"qLRM59yYNeECySsCMATby1\",\"ai.session.id\":\"YOcLuDMIFlduS+5pMUKYZI\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/generic-form//f0swso6qtw%27%22%60'%22/f0swso6qtw/%3E%3Cf0swso6qtw//%3Eap4bvz36c0&\",\"ai.operation.id\":\"d5e13cdc95924effb8a04f03c0c336da\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|d5e13cdc95924effb8a04f03c0c336da.6477a9aaf1b94597.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:01.505\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at t.n [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)

11.11. https://helpdesk-dev.zalaris.com/510/tickets/new/phone-benefits
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/phone-benefits

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.href and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.href and passed to sessionStorage.setItem.value.

The following value was injected into the source and reached the sink without any modification:

https://helpdesk-dev.zalaris.com/510/tickets/new/phone-benefits?h59w0bm2vk=h59w0bm2vk%27%22`'"/h59w0bm2vk/><h59w0bm2vk/\>smed8rzcit&#h59w0bm2vk=h59w0bm2vk%27%22`'"/h59w0bm2vk/><h59w0bm2vk/\>smed8rzcit&

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get href (<anonymous>:1:249544)
at t.getRedirectStartPage (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4027312)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4020367)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at a (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607640)

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at e.setItem (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3842493)
at t.setTemporaryCache (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3864306)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4016322)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607846
at new Promise (<anonymous>)
at d (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607583)
at t.initiateAuthRequest (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4015995)
at t.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4020502)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608805
at Object.next (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3608914)
at a (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3607640)

11.12. https://helpdesk-dev.zalaris.com/510/tickets/new/phone-benefits
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/phone-benefits

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///510/tickets/new/phone-benefits//a718d2cnyp%27%22%60'%22/a718d2cnyp/%3E%3Ca718d2cnyp//%3Elzcg6lku52&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:12:59.615Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"X2s5JRn7RfswT9lvkCsnT8\",\"ai.session.id\":\"X93kOCmKJSCU5V1D1T6VzV\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/phone-benefits//a718d2cnyp%27%22%60'%22/a718d2cnyp/%3E%3Ca718d2cnyp//%3Elzcg6lku52&\",\"ai.operation.id\":\"596431d1198f4da2807250151532eda6\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|596431d1198f4da2807250151532eda6.f73eca327d8447c2.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:04.581\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0},{"item":"{\"time\":\"2025-08-04T05:12:59.550Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"X2s5JRn7RfswT9lvkCsnT8\",\"ai.session.id\":\"X93kOCmKJSCU5V1D1T6VzV\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/phone-benefits//a718d2cnyp%27%22%60'%22/a718d2cnyp/%3E%3Ca718d2cnyp//%3Elzcg6lku52&\",\"ai.operation.id\":\"596431d1198f4da2807250151532eda6\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|596431d1198f4da2807250151532eda6.4f8e59fba56349ca.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"404\",\"duration\":\"00:00:05.225\",\"success\":false,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)

11.13. https://helpdesk-dev.zalaris.com/510/tickets/new/phone-benefits
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/phone-benefits

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///510/tickets/new/phone-benefits//a718d2cnyp%27%22%60'%22/a718d2cnyp/%3E%3Ca718d2cnyp//%3Elzcg6lku52&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:12:59.615Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"X2s5JRn7RfswT9lvkCsnT8\",\"ai.session.id\":\"X93kOCmKJSCU5V1D1T6VzV\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/phone-benefits//a718d2cnyp%27%22%60'%22/a718d2cnyp/%3E%3Ca718d2cnyp//%3Elzcg6lku52&\",\"ai.operation.id\":\"596431d1198f4da2807250151532eda6\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|596431d1198f4da2807250151532eda6.f73eca327d8447c2.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:04.581\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at t.n [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)

11.14. https://helpdesk-dev.zalaris.com/510/tickets/new/predefined-template
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/predefined-template

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///510/tickets/new/predefined-template//xuq0j0apze%27%22%60'%22/xuq0j0apze/%3E%3Cxuq0j0apze//%3Et6apqwjfvg&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:24.352Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"Y4P8hEqvBT3bfiEzRA7J3C\",\"ai.session.id\":\"fHNgvKcVUA8UHLdge1CT8O\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/predefined-template//xuq0j0apze%27%22%60'%22/xuq0j0apze/%3E%3Cxuq0j0apze//%3Et6apqwjfvg&\",\"ai.operation.id\":\"31a6a50e93b94350a88344e1999795a0\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|31a6a50e93b94350a88344e1999795a0.e6555f29c3084dcd.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"404\",\"duration\":\"00:00:00.316\",\"success\":false,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0},{"item":"{\"time\":\"2025-08-04T05:13:24.369Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"Y4P8hEqvBT3bfiEzRA7J3C\",\"ai.session.id\":\"fHNgvKcVUA8UHLdge1CT8O\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/predefined-template//xuq0j0apze%27%22%60'%22/xuq0j0apze/%3E%3Cxuq0j0apze//%3Et6apqwjfvg&\",\"ai.operation.id\":\"31a6a50e93b94350a88344e1999795a0\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|31a6a50e93b94350a88344e1999795a0.3e487cc6ee054fb0.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:00.383\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)

11.15. https://helpdesk-dev.zalaris.com/510/tickets/new/predefined-template
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/predefined-template

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///510/tickets/new/predefined-template//xuq0j0apze%27%22%60'%22/xuq0j0apze/%3E%3Cxuq0j0apze//%3Et6apqwjfvg&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:24.352Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"Y4P8hEqvBT3bfiEzRA7J3C\",\"ai.session.id\":\"fHNgvKcVUA8UHLdge1CT8O\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/predefined-template//xuq0j0apze%27%22%60'%22/xuq0j0apze/%3E%3Cxuq0j0apze//%3Et6apqwjfvg&\",\"ai.operation.id\":\"31a6a50e93b94350a88344e1999795a0\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|31a6a50e93b94350a88344e1999795a0.e6555f29c3084dcd.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"404\",\"duration\":\"00:00:00.316\",\"success\":false,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at t.n [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)

11.16. https://helpdesk-dev.zalaris.com/510/tickets/new/test-template-1
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/test-template-1

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///510/tickets/new/test-template-1//dhi4ffo2av%27%22%60'%22/dhi4ffo2av/%3E%3Cdhi4ffo2av//%3Esxke7gsxl7&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:11.828Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"rRTOBpM2x+v6G2+ds9NQp+\",\"ai.session.id\":\"hmL1N5RBvxRiCyAiNs9Pyw\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/test-template-1//dhi4ffo2av%27%22%60'%22/dhi4ffo2av/%3E%3Cdhi4ffo2av//%3Esxke7gsxl7&\",\"ai.operation.id\":\"d7037df76c8c4242a81f178ba7f57912\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|d7037df76c8c4242a81f178ba7f57912.372716eb1eea4529.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:02.770\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at t.n [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)

11.17. https://helpdesk-dev.zalaris.com/510/tickets/new/test-template-1
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/test-template-1

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///510/tickets/new/test-template-1//dhi4ffo2av%27%22%60'%22/dhi4ffo2av/%3E%3Cdhi4ffo2av//%3Esxke7gsxl7&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:11.828Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"rRTOBpM2x+v6G2+ds9NQp+\",\"ai.session.id\":\"hmL1N5RBvxRiCyAiNs9Pyw\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/test-template-1//dhi4ffo2av%27%22%60'%22/dhi4ffo2av/%3E%3Cdhi4ffo2av//%3Esxke7gsxl7&\",\"ai.operation.id\":\"d7037df76c8c4242a81f178ba7f57912\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|d7037df76c8c4242a81f178ba7f57912.372716eb1eea4529.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:02.770\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0},{"item":"{\"time\":\"2025-08-04T05:13:11.770Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"rRTOBpM2x+v6G2+ds9NQp+\",\"ai.session.id\":\"hmL1N5RBvxRiCyAiNs9Pyw\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/test-template-1//dhi4ffo2av%27%22%60'%22/dhi4ffo2av/%3E%3Cdhi4ffo2av//%3Esxke7gsxl7&\",\"ai.operation.id\":\"d7037df76c8c4242a81f178ba7f57912\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|d7037df76c8c4242a81f178ba7f57912.e25601b4b915486e.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"404\",\"duration\":\"00:00:03.256\",\"success\":false,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)

11.18. https://helpdesk-dev.zalaris.com/510/tickets/new/zalaris-ind
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/zalaris-ind

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///510/tickets/new/zalaris-ind//dyx39nwxa4%27%22%60'%22/dyx39nwxa4/%3E%3Cdyx39nwxa4//%3Eyfijofq1xp&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:14.587Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"oEZVE93jtqlg0j/eGS2fUt\",\"ai.session.id\":\"LeAZN/VmEuQCf727VaJLD7\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/zalaris-ind//dyx39nwxa4%27%22%60'%22/dyx39nwxa4/%3E%3Cdyx39nwxa4//%3Eyfijofq1xp&\",\"ai.operation.id\":\"25af2cafd6b246ccb537c07b09f98378\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|25af2cafd6b246ccb537c07b09f98378.a2013236cfbb41ba.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:01.650\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at t.n [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)

11.19. https://helpdesk-dev.zalaris.com/510/tickets/new/zalaris-ind
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/510/tickets/new/zalaris-ind

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///510/tickets/new/zalaris-ind//dyx39nwxa4%27%22%60'%22/dyx39nwxa4/%3E%3Cdyx39nwxa4//%3Eyfijofq1xp&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:14.587Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"oEZVE93jtqlg0j/eGS2fUt\",\"ai.session.id\":\"LeAZN/VmEuQCf727VaJLD7\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/zalaris-ind//dyx39nwxa4%27%22%60'%22/dyx39nwxa4/%3E%3Cdyx39nwxa4//%3Eyfijofq1xp&\",\"ai.operation.id\":\"25af2cafd6b246ccb537c07b09f98378\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|25af2cafd6b246ccb537c07b09f98378.a2013236cfbb41ba.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:01.650\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0},{"item":"{\"time\":\"2025-08-04T05:13:14.507Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"oEZVE93jtqlg0j/eGS2fUt\",\"ai.session.id\":\"LeAZN/VmEuQCf727VaJLD7\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///510/tickets/new/zalaris-ind//dyx39nwxa4%27%22%60'%22/dyx39nwxa4/%3E%3Cdyx39nwxa4//%3Eyfijofq1xp&\",\"ai.operation.id\":\"25af2cafd6b246ccb537c07b09f98378\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|25af2cafd6b246ccb537c07b09f98378.229ee41660304ebc.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"404\",\"duration\":\"00:00:01.941\",\"success\":false,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)

11.20. https://helpdesk-dev.zalaris.com/777
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/777

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///777//k66903ib6j%27%22%60'%22/k66903ib6j/%3E%3Ck66903ib6j//%3Eqjjbyj4qlj&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:20.262Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"Fs/HQsK+Aq/XmcVvn31Mxw\",\"ai.session.id\":\"7l69o1W0vmUdiyGgRpOUts\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///777//k66903ib6j%27%22%60'%22/k66903ib6j/%3E%3Ck66903ib6j//%3Eqjjbyj4qlj&\",\"ai.operation.id\":\"702891af11cd4f2b9ecbe713b8129db1\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|702891af11cd4f2b9ecbe713b8129db1.813934464b004792.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"404\",\"duration\":\"00:00:00.818\",\"success\":false,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0},{"item":"{\"time\":\"2025-08-04T05:13:20.356Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"Fs/HQsK+Aq/XmcVvn31Mxw\",\"ai.session.id\":\"7l69o1W0vmUdiyGgRpOUts\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///777//k66903ib6j%27%22%60'%22/k66903ib6j/%3E%3Ck66903ib6j//%3Eqjjbyj4qlj&\",\"ai.operation.id\":\"702891af11cd4f2b9ecbe713b8129db1\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|702891af11cd4f2b9ecbe713b8129db1.a01dafff1fec4410.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:01.044\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)

11.21. https://helpdesk-dev.zalaris.com/777
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/777

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///777//k66903ib6j%27%22%60'%22/k66903ib6j/%3E%3Ck66903ib6j//%3Eqjjbyj4qlj&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:20.262Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"Fs/HQsK+Aq/XmcVvn31Mxw\",\"ai.session.id\":\"7l69o1W0vmUdiyGgRpOUts\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///777//k66903ib6j%27%22%60'%22/k66903ib6j/%3E%3Ck66903ib6j//%3Eqjjbyj4qlj&\",\"ai.operation.id\":\"702891af11cd4f2b9ecbe713b8129db1\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|702891af11cd4f2b9ecbe713b8129db1.813934464b004792.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"404\",\"duration\":\"00:00:00.818\",\"success\":false,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at t.n [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)

11.22. https://helpdesk-dev.zalaris.com/777/tickets/new/phone-benefits
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/777/tickets/new/phone-benefits

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///777/tickets/new/phone-benefits//vi01uzoo7v%27%22%60'%22/vi01uzoo7v/%3E%3Cvi01uzoo7v//%3Eh7kq2knpq4&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:23.823Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"0eNepa9K7cNNHkNKoYaH8P\",\"ai.session.id\":\"Y1n6gCMkeFkyOi830IFJOQ\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///777/tickets/new/phone-benefits//vi01uzoo7v%27%22%60'%22/vi01uzoo7v/%3E%3Cvi01uzoo7v//%3Eh7kq2knpq4&\",\"ai.operation.id\":\"3fa7139a10cb4348a7afce9872185ca1\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|3fa7139a10cb4348a7afce9872185ca1.bd4b41181f9e4844.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:00.330\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0},{"item":"{\"time\":\"2025-08-04T05:13:23.740Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"0eNepa9K7cNNHkNKoYaH8P\",\"ai.session.id\":\"Y1n6gCMkeFkyOi830IFJOQ\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///777/tickets/new/phone-benefits//vi01uzoo7v%27%22%60'%22/vi01uzoo7v/%3E%3Cvi01uzoo7v//%3Eh7kq2knpq4&\",\"ai.operation.id\":\"3fa7139a10cb4348a7afce9872185ca1\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|3fa7139a10cb4348a7afce9872185ca1.37cb2a1255634ad0.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"404\",\"duration\":\"00:00:00.556\",\"success\":false,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en-US/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)

11.23. https://helpdesk-dev.zalaris.com/777/tickets/new/phone-benefits
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/777/tickets/new/phone-benefits

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///777/tickets/new/phone-benefits//vi01uzoo7v%27%22%60'%22/vi01uzoo7v/%3E%3Cvi01uzoo7v//%3Eh7kq2knpq4&

The previous value reached the sink as:

[{"item":"{\"time\":\"2025-08-04T05:13:23.823Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"0eNepa9K7cNNHkNKoYaH8P\",\"ai.session.id\":\"Y1n6gCMkeFkyOi830IFJOQ\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///777/tickets/new/phone-benefits//vi01uzoo7v%27%22%60'%22/vi01uzoo7v/%3E%3Cvi01uzoo7v//%3Eh7kq2knpq4&\",\"ai.operation.id\":\"3fa7139a10cb4348a7afce9872185ca1\",\"ai.cloud.role\":\"helpdesk-webapp\",\"ai.internal.sdkVersion\":\"javascript:3.3.7\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|3fa7139a10cb4348a7afce9872185ca1.bd4b41181f9e4844.\",\"ver\":2,\"name\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"resultCode\":\"200\",\"duration\":\"00:00:00.330\",\"success\":true,\"data\":\"GET https://helpdesk-dev.zalaris.com/locales/en/locale.json?v=0.0.1-SNAPSHOT\",\"target\":\"helpdesk-dev.zalaris.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}","cnt":0}]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new OZ (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4357639)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359722
at um (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4080635)
at new e (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4359469)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4361982
at e.initialize (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4362557)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268189)
at yr (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:3654211)
at KF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4268152)
at V (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4277245)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4280162)
at e.n [as initialize] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366479
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4366411)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4371138
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380670
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:6380674

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at zR (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4207541)
at g (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4227984)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4228585)
at t.n [as enqueue] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4243589)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4273713)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4274404)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)
at https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271003
at FF (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4267708)
at c (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4270907)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271258)
at JF.a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4269810)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4173126)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4181042)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4079449)
at r (https://helpdesk-dev.zalaris.com/static/js/main.375be96b.js:2:4271248)

11.24. https://helpdesk-dev.zalaris.com/management/links/new
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/management/links/new

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///management/links/new//go6j6qwse9%27%22%60'%22/go6j6qwse9/%3E%3Cgo6j6qwse9//%3Efuvuj75znt&

The previous value reached the sink as:

["{\"time\":\"2025-08-04T05:13:24.366Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"IlnwffL9PmM+Vnj+5kyZh0\",\"ai.session.id\":\"ckrfVwZa9203GP3fkUhkfy\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///management/links/new//go6j6qwse9%27%22%60'%22/go6j6qwse9/%3E%3Cgo6j6qwse9//%3Efuvuj75znt&\",\"ai.operation.id\":\"5e61f62add4f429391845121549d1fa0\",\"ai.cloud.role\":\"helpdesk-management-webapp\",\"ai.internal.sdkVersion\":\"javascript:2.8.16\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|5e61f62add4f429391845121549d1fa0.7530b83dce1b4c9c.\",\"ver\":2,\"name\":\"GET https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=https://login.microsoftonline.com/a16eb8e2-803d-4f22-849c-f3f335a60a39/oauth2/v2.0/authorize\",\"resultCode\":\"200\",\"duration\":\"00:00:00.225\",\"success\":true,\"data\":\"GET https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=https://login.microsoftonline.com/a16eb8e2-803d-4f22-849c-f3f335a60a39/oauth2/v2.0/authorize\",\"target\":\"login.microsoftonline.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}"]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new $C (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3799854)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3801719
at rm (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3699591)
at new e (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3801492)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3803690
at e.initialize (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3803838)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3713121)
at To (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3239563)
at qg (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3713084)
at O (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3776148)
at e.<computed> (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3777906)
at Object.initialize (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3699391)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3781056)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3806873
at Nv (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3708033)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3806756)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3810010
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:5415834
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:5415838

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at nb (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3721621)
at p (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3756750)
at e.<computed> [as markAsSent] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3757315)
at t.n [as markAsSent] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at t.x [as _sender] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3764566)
at e.<computed> [as triggerSend] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3770896)
at t.n [as triggerSend] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at Arguments.<anonymous> (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3766083)
at <anonymous>:1:508906
at _ (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3766048)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3770239)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at r (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716051)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715806
at Nv (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3708033)
at c (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715710)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716061)
at Qg.i.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3714632)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3775120
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3774847)
at To (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3239563)
at r (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3774774)
at Object.processTelemetry (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3775091)
at r (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716051)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715806

11.25. https://helpdesk-dev.zalaris.com/management/links/new
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/management/links/new

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///management/links/new//go6j6qwse9%27%22%60'%22/go6j6qwse9/%3E%3Cgo6j6qwse9//%3Efuvuj75znt&

The previous value reached the sink as:

["{\"time\":\"2025-08-04T05:13:24.690Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"IlnwffL9PmM+Vnj+5kyZh0\",\"ai.session.id\":\"ckrfVwZa9203GP3fkUhkfy\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///management/links/new//go6j6qwse9%27%22%60'%22/go6j6qwse9/%3E%3Cgo6j6qwse9//%3Efuvuj75znt&\",\"ai.operation.id\":\"5e61f62add4f429391845121549d1fa0\",\"ai.cloud.role\":\"helpdesk-management-webapp\",\"ai.internal.sdkVersion\":\"javascript:2.8.16\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|5e61f62add4f429391845121549d1fa0.d47189a8a0eb48cb.\",\"ver\":2,\"name\":\"GET https://login.microsoftonline.com/a16eb8e2-803d-4f22-849c-f3f335a60a39/v2.0/.well-known/openid-configuration\",\"resultCode\":\"200\",\"duration\":\"00:00:00.372\",\"success\":true,\"data\":\"GET https://login.microsoftonline.com/a16eb8e2-803d-4f22-849c-f3f335a60a39/v2.0/.well-known/openid-configuration\",\"target\":\"login.microsoftonline.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}"]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new $C (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3799854)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3801719
at rm (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3699591)
at new e (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3801492)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3803690
at e.initialize (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3803838)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3713121)
at To (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3239563)
at qg (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3713084)
at O (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3776148)
at e.<computed> (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3777906)
at Object.initialize (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3699391)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3781056)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3806873
at Nv (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3708033)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3806756)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3810010
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:5415834
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:5415838

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at nb (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3721621)
at p (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3756750)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3757027)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3770235)
at r (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716051)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715806
at Nv (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3708033)
at c (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715710)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716061)
at Qg.i.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3714632)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3775120
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3774847)
at To (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3239563)
at r (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3774774)
at Object.processTelemetry (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3775091)
at r (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716051)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715806
at Nv (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3708033)
at c (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715710)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716061)
at Qg.i.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3714632)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3718020)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3773265)
at r (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716051)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715806

This was triggered by a readystatechange event.

11.26. https://helpdesk-dev.zalaris.com/management/links/new
Previous

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/management/links/new

Issue detail

The application may be vulnerable to DOM-based HTML5 storage manipulation. Data is read from location.pathname and passed to sessionStorage.setItem.value.

Request 1

Response 1

Dynamic analysis

Data is read from location.pathname and passed to sessionStorage.setItem.value.

The following value was injected into the source:

///management/links/new//go6j6qwse9%27%22%60'%22/go6j6qwse9/%3E%3Cgo6j6qwse9//%3Efuvuj75znt&

The previous value reached the sink as:

["{\"time\":\"2025-08-04T05:13:24.366Z\",\"iKey\":\"56375f0e-24b1-4e3d-af7f-8a8429f358bf\",\"name\":\"Microsoft.ApplicationInsights.56375f0e24b14e3daf7f8a8429f358bf.RemoteDependency\",\"tags\":{\"ai.user.id\":\"IlnwffL9PmM+Vnj+5kyZh0\",\"ai.session.id\":\"ckrfVwZa9203GP3fkUhkfy\",\"ai.device.id\":\"browser\",\"ai.device.type\":\"Browser\",\"ai.operation.name\":\"///management/links/new//go6j6qwse9%27%22%60'%22/go6j6qwse9/%3E%3Cgo6j6qwse9//%3Efuvuj75znt&\",\"ai.operation.id\":\"5e61f62add4f429391845121549d1fa0\",\"ai.cloud.role\":\"helpdesk-management-webapp\",\"ai.internal.sdkVersion\":\"javascript:2.8.16\"},\"data\":{\"baseType\":\"RemoteDependencyData\",\"baseData\":{\"id\":\"|5e61f62add4f429391845121549d1fa0.7530b83dce1b4c9c.\",\"ver\":2,\"name\":\"GET https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=https://login.microsoftonline.com/a16eb8e2-803d-4f22-849c-f3f335a60a39/oauth2/v2.0/authorize\",\"resultCode\":\"200\",\"duration\":\"00:00:00.225\",\"success\":true,\"data\":\"GET https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=https://login.microsoftonline.com/a16eb8e2-803d-4f22-849c-f3f335a60a39/oauth2/v2.0/authorize\",\"target\":\"login.microsoftonline.com\",\"type\":\"Fetch\",\"properties\":{\"HttpMethod\":\"GET\"},\"measurements\":{}}}}"]

The stack trace at the source was:

at Object._0x165f99 [as proxiedGetterCallback] (<anonymous>:1:557377)
at get pathname (<anonymous>:1:249642)
at new $C (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3799854)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3801719
at rm (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3699591)
at new e (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3801492)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3803690
at e.initialize (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3803838)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3713121)
at To (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3239563)
at qg (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3713084)
at O (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3776148)
at e.<computed> (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3777906)
at Object.initialize (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3699391)
at e.<computed> [as initialize] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3781056)
at t.n [as initialize] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3806873
at Nv (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3708033)
at e.loadAppInsights (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3806756)
at e.n [as loadAppInsights] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3810010
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:5415834
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:5415838

The stack trace at the sink was:

at Object.XMhUr (<anonymous>:1:544502)
at _0x13dcf0 (<anonymous>:1:558761)
at Object.lkSNo (<anonymous>:1:101155)
at Object.ZAQld (<anonymous>:1:455018)
at Storage.setItem (<anonymous>:1:456256)
at nb (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3721621)
at p (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3756750)
at e.<computed> [as enqueue] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3757027)
at t.n [as enqueue] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at e.processTelemetry (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3770235)
at t.n [as processTelemetry] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3698452)
at r (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716051)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715806
at Nv (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3708033)
at c (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715710)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716061)
at Qg.i.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3714632)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3775120
at Array.<anonymous> (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3774847)
at To (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3239563)
at r (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3774774)
at Object.processTelemetry (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3775091)
at r (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716051)
at https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715806
at Nv (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3708033)
at c (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3715710)
at Object.u [as processTelemetry] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3716061)
at Qg.i.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3714632)
at a.<computed> [as processNext] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3718020)
at e.<computed> [as processTelemetry] (https://helpdesk-dev.zalaris.com/management/static/js/main.c850c2ef.js:2:3773265)

12. Base64-encoded data in parameter
Previous  Next

Summary

	Severity:	Information
	Confidence:	Firm
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/777

Issue detail

The following parameter appears to contain Base64-encoded data:

• msal.002b5283-fdf4-40c1-aeaa-8c87da51c0ab.request.params = {"correlationId":"ad59ba6a-2348-4ade-963f-e20f5f265b13","scopes":["openid","email","002b5283-fdf4-40c1-aeaa-8c87da51c0ab"],"state":"eyJpZCI6IjAxNjU0YWUzLTZhYWYtNDkxZC05ZTkxLWRjOTlkYmIyZDlhMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoicmVkaXJlY3QifX0=|https://helpdesk-dev.zalaris.com","extraQueryParameters":{"domain_hint":"777"},"authority":"https://alumnidev.b2clogin.com/alumnidev.onmicrosoft.com/b2c_1_helpdesk","authenticationScheme":"Bearer","redirectUri":"https://helpdesk-dev.zalaris.com","nonce":"c3094122-5dfe-4330-819e-94daf995aa7b","responseMode":"fragment","code":"","codeVerifier":"H7Br-97bLuYzwsQPxPSBDmgdUfZ3og4tA4FJsB2mF9g"}

Issue background

Applications sometimes Base64-encode parameters in an attempt to obfuscate them from users or facilitate transport of binary data. The presence of Base64-encoded data may indicate security-sensitive information or functionality that is worthy of further investigation. The data should be reviewed to determine whether it contains any interesting information, or provides any additional entry points for malicious input.

Vulnerability classifications

• CWE-310: Cryptographic Issues
• CWE-311: Missing Encryption of Sensitive Data
• CAPEC-37: Retrieve Embedded Sensitive Data

Request 1

Response 1

13. TLS certificate
Previous

Summary

	Severity:	Information
	Confidence:	Certain
	Host:	https://helpdesk-dev.zalaris.com
	Path:	/

Issue detail

The server presented a valid, trusted TLS certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	*.zalaris.com, zalaris.com
Issued by:	DigiCert Global G2 TLS RSA SHA256 2020 CA1
Valid from:	Thu Aug 01 17:00:00 PDT 2024
Valid to:	Tue Sep 02 16:59:59 PDT 2025

Certificate chain #1

Issued to:	DigiCert Global G2 TLS RSA SHA256 2020 CA1
Issued by:	DigiCert Global Root G2
Valid from:	Mon Mar 29 17:00:00 PDT 2021
Valid to:	Sat Mar 29 16:59:59 PDT 2031

Certificate chain #2

Issued to:	DigiCert Global Root G2
Issued by:	DigiCert Global Root G2
Valid from:	Thu Aug 01 05:00:00 PDT 2013
Valid to:	Fri Jan 15 04:00:00 PST 2038

Issue background

TLS (or SSL) helps to protect the confidentiality and integrity of information in transit between the browser and server, and to provide authentication of the server's identity. To serve this purpose, the server must present an TLS certificate that is valid for the server's hostname, is issued by a trusted authority and is valid for the current date. If any one of these requirements is not met, TLS connections to the server will not provide the full protection for which TLS is designed.

It should be noted that various attacks exist against TLS in general, and in the context of HTTPS web connections in particular. It may be possible for a determined and suitably-positioned attacker to compromise TLS connections without user detection even when a valid TLS certificate is used.

References

• SSL/TLS Configuration Guide

Vulnerability classifications

• CWE-295: Improper Certificate Validation
• CWE-326: Inadequate Encryption Strength
• CWE-327: Use of a Broken or Risky Cryptographic Algorithm

Report generated by Burp Suite web vulnerability scanner v2025.6.5, at Mon Aug 04 00:09:47 PDT 2025.